AuthenticationContext persistence

[Cantor, Scott]

On 8/29/16, 8:45 PM, "dev on behalf of Klingenstein, Nate" <dev-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> So active in this sense is... active only on this... what?

The objects in getActiveResults come from the IdPSession and are populated from scratch from the session during the processing of a request because that's a feature built into the authn subflow logic, in an action (ExtractActiveAuthenticationResults). They are persisted only in the IdPSession where they came from. They're only in the context tree for the life of a single request and then they're garbage collected like everything else in the tree.

Every flow execution is connected to a Java session and keyed inside the session by the execution key in the "eNsN" parameter. SWF looks up the execution state by key and session and restores that so when the flow resumes it's operating on the right context tree. The tree lasts for the flow execution's life, or gets thrown out if the execution times out.

> I would have assumed that a view state was terminal for a particular request since it has
> to be viewed by a user.

No. The point of SWF is to connect interactions that span multiple views. A "request" is the complete execution of a flow from start to end state, with any number of views in between.

Subflows are like subroutines or functions, but they're also flows in their own right that might be going back and forth between the browser many times.

Most of the system is built from subflows. The only top-level flows are the SAML and CAS features, logout, and a few administrative functions. Everything else is a subflow that's picking up work at a point in the process, mutating the tree into some state, and then signaling a result.

A login flow is running at least 2 "stack frames" in:

SAML SSO / CAS Login
	-> authn subflow
		-> login subflow

It's even deeper when a login flow is finishing work, in 3.3 anyway:

SAML SSO / CAS SSO
	-> authn subflow
		-> login subflow
			-> c14n subflow
				-> c14n subflow

-- Scott