authentication process, subflows, and SubjectContext creation

[Cantor, Scott]

On 1/16/16, 4:14 PM, "dev on behalf of Scott Koranda" <dev-bounces at shibboleth.net on behalf of skoranda at gmail.com> wrote:



>Hi,
>
>I am looking in detail at this page in the wiki:
>
>https://wiki.shibboleth.net/confluence/display/IDP30/Authentication

Based on the modification date I'm sure that's not entirely accurate. I'm sure it doesn't know about the initial authentication feature for example. Most of the authentication code was written in 2013, but there have been lots of small and some large changes since then.

>Once the Password flow completes (as a subflow), is a SubjectContext
>created and available as outlined in step 6? Or is that only after
>the flow that called Password completes?

No, the step that creates the SubjectContext is at the very end in the "master" authentication subflow.

That is, profile flows that do authentication call the flow named "authn". That flow in turn coordinates calling login subflows, and the end of the "authn" flow has a step called FinalizeAuthentication that does the final checks and cleanup and ends up producing a SubjectContext with the result.

Until that runs, everything is just tracked via the AuthenticationContext as the intermediate non-final state of the process.

>Put another way, is this statement on the wiki page
>
>"Success will populate a SubjectContext as a child of the
>ProfileRequestContext"
>
>true when the flow is only invoked as a subflow?

It's not true in either case. The job of login flows (or subflows if you like) is to produce an AuthenticationResult (and includes performing SubjectCanonicalization on that result), but never to produce the final SubjectContext.

It's possible to have one login flow call another pretty harmlessly without any special care because they're both just producing intermediate state.

You can't ever break the "final" contract with the SP because the resulting Subject is always cross-checked at the FinalizeAuthentication step to verify that the SP's requested principal criteria are satisfied.

-- Scott