Local SSO integration with IdP 5.1.1

[Christopher Bongaarts]

I think I'm close. Using this map chunk:

<entry key="authn/External">
             <bean parent="shibboleth.authn.MFA.Transition">
                 <property name="nextFlowStrategyMap">
                     <map>
                         <entry key="proceed" value="proceed" />
                         <entry key="*" value="authn/Password" />
                     </map>
                 </property>
             </bean>
         </entry>

yields the correct behavior when the external authn succeeds (MFA stops 
and completes successfully).

When external authn fails, it correctly routes to the authn/Password 
flow, but the password page shows an error/warning atop the 
username/password form:

"User login was not successful or could not meet the requirements of the 
requesting application."

which is the expected error message from the NoCredentials event that 
the External flow returns if you don't give it a principal/Subject.  I'd 
like to suppress this message in this case, but not sure the best way to 
accomplish that.

On 4/16/2024 7:28 AM, Cantor, Scott wrote:
>> - if external flow was successful (got an AuthenticationResult), STOP -
>> we're done return success from MFA flow
> It's implicit. Not having a rule handling a transition completes the flow in whatever state it's in, success or not.
>
>> - else continue to next (formerly original) flow, authn/Password
> You either dispatch on the wildcard character or you catch specific events to route on, either way.
>
> -- Scott
>
>

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%