3.3 SNAPSHOT: AuthN resolveAttribute not activating authn flow

[Cantor, Scott]

> On a brand new request, I can see the IdP attempts to resolve
> “requiredAuthnCtx" and filter flows. Logs show:
> 
> > Retaining flow authn/TB, matched custom Principal
> https://www.example.edu/q
> > Profile Action SelectAuthenticationFlow: No specific Principals requested
> (Misagh: this is odd, surely.)

No, not odd. The "matched" line is coming from the filtering action that checks the attribute's values for compatibility. That doesn't imply anything in the request is asking for anything in particular. Given that, anything left after filtering (active or inactive) should be usable.

> > Profile Action SelectAuthenticationFlow: Reusing active result authn/Password
> ...and the custom TB flow is never activated.

I can't say whether it should or shouldn't based on that information. By default, the filtering action applies to both flows and results, meaning it will filter out the Password result if and only if the attribute values don't include a value that matches it.

> However, I simply log out of the SP and attempt to authenticate again, this
> time the IdP activates the TB flow having retained it just like last time:
> 
> > Profile Action SelectAuthenticationFlow: No specific Principals requested
> > Profile Action SelectAuthenticationFlow: No usable active results available,
> selecting an inactive flow
> > Profile Action SelectAuthenticationFlow: Selecting inactive authentication
> flow authn/TB

That implies that the Password result is not the same as the static description of the Password flow's supported principals. The result must have more inside the Subject in the first case vs the second.

> Needless to say, the changes I have worked great against 3.2.1. Also I can't
> be sure on dates exactly, but I think this worked against 3.3-SNAPSHOT early
> last week.

I don't know of anything in weeks that would have impacted that code.

> What might I be missing? Is there anything I can share from the logs to help
> explain the issue better?

Maybe at least with the password configuration I could take a stab at it. Shouldn't matter that much what the secondary flow is, I just need to set up the primary the way you are and know what the attribute value(s) are for the user.

There also seems like a ton of logging elided there.

-- Scott