intercept flow detect first authentication

[Cantor, Scott]

> Did you mean something like this?

Well, I was really just talking about the condition to check, be it in Java code or otherwise. It's not always super-easy to do everything with Spring expressions.

>    <action-state id="ImmediatelyAfterAuthentication">
>         <evaluate
> expression="opensamlProfileRequestContext.getSubcontext(T(net.shibbole
> th.idp.authn.context.AuthenticationContext))"
> result="flowScope.authenticationContext" />

You generally can't do that sort of thing, you have to put pure expression evaluation into the state's <on-entry> block or whatever it's called.

>         <evaluate
> expression="authenticationContext.getAuthenticationResult()"
> result="flowScope.authenticationResult" />
>         <evaluate
> expression="java.lang.Boolean(authenticationContext.getActiveResults().val
> ues().contains(authenticationResult))" />
>         <transition on="yes" to="MyNextState" />
>         <transition on="no" to="proceed" />

You don't get yes or no back from that, it's just a boolean expression. It's something you'd evaluate in a decision-state if you were trying to avoid writing Java beans to do the work and just signal events that way.

> I get "Cannot find state with id 'success' in flow", presumably because
> SWF is getting something other than a boolean/Boolean and mapping it to
> the generic "success".

You get "success" any time you evaluate an expression inside an action-state proper. You have to avoid it by moving the evaluates into an <on-entry> block so it doesn't try and transition off them.

-- Scott