idp auth module plugin

[Cantor, Scott]

On 7/28/22, 3:40 PM, "dev on behalf of Paul Henson" <dev-bounces at shibboleth.net on behalf of henson at signet.id> wrote:

> However, 
> there is a requirement to be able to cancel the ping in progress and 
> select a different authentication method. If I have a link on the status 
> page with an event to allow that, if it is clicked after the status page 
>  has already auto submitted the proceed event, I assume someone clicking
>  on that link while the browser is spinning would end up getting an error?
>
>    Any suggestions on the best mechanism to handle this?

SWF is not capable of this kind of thing as far as I know or if it can it's that dead Java Server Faces or Tiles stuff.

We came up with a crazy (and unreliable, based on what I'm hearing) tricks to do this with logout, but the way we did it was to implement new top level flows that we invoke in iframes. But we can pull that off because they're really separate transactions from the original and we don't attempt to "join" the finishing of the separate calls with the completion of the primary call, which is why the IdP can't actually tell an SP whether the whole SLO attempt worked or not.

That would not work well here, but the analogy would be that the cancellable method is its own flow that has to be receiving sealed/secured input to drive it, and somehow drop the result somewhere it would be safe to pick up, and then somehow synchronize the whole mess so the view knows how to proceed.

-- Scott