3.3 SNAPSHOT: AuthN resolveAttribute not activating authn flow

[Misagh Moayyed]

I am troubleshooting a bizzar case where IdP 3.3-SNAPSHOT freshly built as of 5 minutes ago is not switching a custom authentication flow that is indicated by "idp.authn.resolveAttribute”. 

Here is the setup:

idp.authn.flows = Password|TB
idp.authn.flows.initial = Password
idp.authn.resolveAttribute = requiredAuthnCtx

On a brand new request, I can see the IdP attempts to resolve “requiredAuthnCtx" and filter flows. Logs show:

> Retaining flow authn/TB, matched custom Principal https://www.example.edu/q
> Profile Action SelectAuthenticationFlow: No specific Principals requested (Misagh: this is odd, surely.) 
> Profile Action SelectAuthenticationFlow: Reusing active result authn/Password

...and the custom TB flow is never activated. 

However, I simply log out of the SP and attempt to authenticate again, this time the IdP activates the TB flow having retained it just like last time:

> Profile Action SelectAuthenticationFlow: No specific Principals requested
> Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
> Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/TB

Needless to say, the changes I have worked great against 3.2.1. Also I can't be sure on dates exactly, but I think this worked against 3.3-SNAPSHOT early last week.

What might I be missing? Is there anything I can share from the logs to help explain the issue better?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20161024/97e4a61f/attachment-0001.html>