CallExtendedFlow for Custom Password Help Flow

[Marvin Addison]

We are refactoring a custom authn flow into the new MFA framework and need
to support a subflow that helps users with forgotten username/password.
Formerly we simply called into this subflow directly, but it looks like
the CallExtendedFlow state of the Password flow ought to be able to do the
same thing. But I'm having problems with a NPE apparently due to the fact
that the flow isn't in the AuthenticationContext#getPotentialFlows()
collection. I'm scratching my head where else I need to define the flow
other than as a bean in conf/authn/general-authn.xml and updating
idp.authn.flows in idp.properties:

diff --git a/idp/conf/authn/general-authn.xml
b/idp/conf/authn/general-authn.xml
index 13c429c..5a06b9d 100644
--- a/idp/conf/authn/general-authn.xml
+++ b/idp/conf/authn/general-authn.xml
@@ -112,6 +112,15 @@
             </property>
         </bean>

+        <!-- The following is an extended flow called from Password -->
+        <bean id="authn/conditions/iforgot"
parent="shibboleth.AuthenticationFlow"
+                p:forcedAuthenticationSupported="false"
+                p:nonBrowserSupported="false">
+            <property name="supportedPrincipals">
+                <util:list />
+            </property>
+        </bean>
+
     </util:list>

     <!--
diff --git a/idp/conf/idp.properties b/idp/conf/idp.properties
index c1a28ba..575d4c5 100644
--- a/idp/conf/idp.properties
+++ b/idp/conf/idp.properties
@@ -89,7 +89,7 @@ idp.session.secondaryServiceIndex = true
 idp.session.defaultSPlifetime = PT24H

 # Regular expression matching login flows to enable, e.g.
IPAddress|Password
-idp.authn.flows= X509Internal|MFA|Password|X509
+idp.authn.flows= X509Internal|MFA|Password|X509|conditions/iforgot

The flow definition files are where they need to be; that hasn't changed
from our previous implementation. The only other place I can think to
define it is in the RP configuration, which I have not done intentionally
to prevent it from being selected as a top-level authn flow.

Can someone point me in the right direction?

Thanks,
M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160810/f7702fec/attachment.html>