intercept flow detect first authentication

[Scott Koranda]

> > What is the most elegant way for a post-authentication
> > intercept flow to only "fire" after the first authentication
> > and not as part of any future SSO flows?
> 
> I'm not sure there's an elegant way, and my brain's inside the SP right this second, but I think you could check to see if AuthenticationContext.getAuthenticationResult() is contained within AuthenticationContext.getActiveResults().valueSet()
> 
> I overrode AuthenticationResult.equals() so that equality is based on the flow ID and the authentication timestamp, so that should guarantee it's the same act.
> 

Did you mean something like this?

   <action-state id="ImmediatelyAfterAuthentication">
        <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="flowScope.authenticationContext" />
        <evaluate expression="authenticationContext.getAuthenticationResult()" result="flowScope.authenticationResult" />
        <evaluate expression="java.lang.Boolean(authenticationContext.getActiveResults().values().contains(authenticationResult))" />
        <transition on="yes" to="MyNextState" />
        <transition on="no" to="proceed" />
   </action-state>

I get "Cannot find state with id 'success' in flow", presumably because
SWF is getting something other than a boolean/Boolean and mapping it to the
generic "success".

Scott K