Local SSO integration with IdP 5.1.1

[Christopher Bongaarts]

I built an external.jsp that implements the logic I had previously built 
in my AuthenticationAction; that wasn't too bad.

Stuck for the moment on how to implement this in the MFA flow map, the 
logic I would want is:

- if external flow was successful (got an AuthenticationResult), STOP - 
we're done return success from MFA flow
- else continue to next (formerly original) flow, authn/Password

I'm pretty sure I can get the first one with something like:

<entry key="authn/External">
             <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlowStrategy-ref=??? />
         </entry>
but not sure what strategy would go there to detect the results of the 
current flow and return null (or "proceed?") vs "authn/Password".

On 4/10/2024 7:42 AM, Cantor, Scott wrote:
> Maybe I'm missing something, but isn't this a pretty straightforward use case for the External login method?
>
>> (1a) Build a brand new authn flow and invoke it from our MFA script
>> near the top. Advantage: probably no more need to mess with impl
>> classes.
> That's a necessity, not an advantage. You should *never* modify our flows, even if that works, it will destroy your ability to upgrade eventually. No convenience is worth that risk, it's just not even an option you should consider.
>
> Copying impl classes is bad, but modifying flows is much worse.
>
> I don't see why you'd need a whole new flow, External will punt out to your own code for this without any special effort other than implementing the part you'd already have implemented.
>
> -- Scott
>
>

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%