<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px">
<div id="yui_3_16_0_1_1453428722229_50941" style="background: white; margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50943" style='font-family:"Helvetica",sans-serif;
color:black'>Hi, Shibboleth experts,</span></div>
<div id="yui_3_16_0_1_1453428722229_50945" style="background: white; margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50947" style='font-family:"Helvetica",sans-serif;
color:black'> </span></div>
<div id="yui_3_16_0_1_1453428722229_50949" style="background: white; margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50951" style='font-family:"Helvetica",sans-serif;
color:black'>We want to extend the idp authentication flow to integrate
Shibboleth IDP with our backend SSO system. I am very new to Shibboleth,
so I want to learn how to write a simplest authentication flow extension as my
starting point. But I do not know how to create and pass the
SubjectCanonicalizationContext from the authentication flow to c14n subflow.</span></div>
<div id="yui_3_16_0_1_1453428722229_50953" style="background: white; margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50955" style='font-family:"Helvetica",sans-serif;
color:black'> </span></div>
<div id="yui_3_16_0_1_1453428722229_50957" style="background: white; margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50959" style='font-family:"Helvetica",sans-serif;
color:black'>Reading the Shibboleth document,<a id="yui_3_16_0_1_1453428722229_50961" href="https://wiki.shibboleth.net/confluence/display/IDP30/Authentication" target="_blank"><font id="yui_3_16_0_1_1453428722229_50963" color="#0563c1"> Authentication - Identity Provider 3 - Confluence</font></a>, the end
result of the authentication flow is to produce an AuthenticationResult as part
of AuthenticationContext. </span></div>
<div id="yui_3_16_0_1_1453428722229_50965" style="background: white; margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50967" style='font-family:"Helvetica",sans-serif;
color:black'> </span></div>
<div id="yui_3_16_0_1_1453428722229_50969" style="margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50971" style='font-family:"Helvetica",sans-serif;color:black'>So
I started out by developing a dummy authentication flow that does nothing but
simply populates a hardcoded UsernamePrincipal object into AuthenticationResult
object and then add the AuthenticationResult object to the
AuthenticationContext:</span></div>
<div id="yui_3_16_0_1_1453428722229_50973" style="margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_50975" style='font-family:"Helvetica",sans-serif;color:black'> </span></div>
<div id="yui_3_16_0_1_1453428722229_50977" style="margin: 0in 0in 0pt 0.5in; text-indent: -0.25in;"><span id="yui_3_16_0_1_1453428722229_50979" style='font-family:"Helvetica",sans-serif;mso-fareast-font-family:Helvetica;
mso-bidi-font-family:Helvetica;color:black'><span id="yui_3_16_0_1_1453428722229_50981" style="mso-list:Ignore">1.<span id="yui_3_16_0_1_1453428722229_50983" style='font:7.0pt "Times New Roman"'> </span></span></span><span id="yui_3_16_0_1_1453428722229_50985" style='font-family:"Helvetica",sans-serif;color:black'>Create UsernameContext
with hardcoded username and add it to AuthenticationContext. Not sure if I need
to do this.</span></div>
<div id="yui_3_16_0_1_1453428722229_50987" style="margin: 0in 0in 0pt 0.5in; text-indent: -0.25in;"><span id="yui_3_16_0_1_1453428722229_50989" style='font-family:"Helvetica",sans-serif;mso-fareast-font-family:Helvetica;
mso-bidi-font-family:Helvetica;color:black'><span id="yui_3_16_0_1_1453428722229_50991" style="mso-list:Ignore">2.<span id="yui_3_16_0_1_1453428722229_50993" style='font:7.0pt "Times New Roman"'> </span></span></span><span id="yui_3_16_0_1_1453428722229_50995" style='font-family:"Helvetica",sans-serif;color:black'>Create
AuthenticationResult Object</span></div>
<div id="yui_3_16_0_1_1453428722229_50997" style="margin: 0in 0in 0pt 0.5in; text-indent: -0.25in;"><span id="yui_3_16_0_1_1453428722229_50999" style='font-family:"Helvetica",sans-serif;mso-fareast-font-family:Helvetica;
mso-bidi-font-family:Helvetica;color:black'><span id="yui_3_16_0_1_1453428722229_51001" style="mso-list:Ignore">3.<span id="yui_3_16_0_1_1453428722229_51003" style='font:7.0pt "Times New Roman"'> </span></span></span><span id="yui_3_16_0_1_1453428722229_51005" style='font-family:"Helvetica",sans-serif;color:black'>Create a </span><font id="yui_3_16_0_1_1453428722229_51007" face="Calibri">javax.security.auth.Subject
with hardcoded Principals and add it to AuthenticationResult object</font></div>
<div id="yui_3_16_0_1_1453428722229_51009" style="margin: 0in 0in 0pt 0.5in; text-indent: -0.25in;"><span id="yui_3_16_0_1_1453428722229_51011" style='font-family:"Helvetica",sans-serif;mso-fareast-font-family:Helvetica;
mso-bidi-font-family:Helvetica;color:black'><span id="yui_3_16_0_1_1453428722229_51013" style="mso-list:Ignore">4.<span id="yui_3_16_0_1_1453428722229_51015" style='font:7.0pt "Times New Roman"'> </span></span></span><span id="yui_3_16_0_1_1453428722229_51017" style='font-family:"Helvetica",sans-serif;color:black'>Finally, add
AuthenticationResult Object to AuthenticationContext.</span></div>
<div id="yui_3_16_0_1_1453428722229_51019" style="margin: 0in 0in 0pt 0.5in; text-indent: -0.25in;"><span id="yui_3_16_0_1_1453428722229_51021" style='font-family:"Helvetica",sans-serif;mso-fareast-font-family:Helvetica;
mso-bidi-font-family:Helvetica;color:black'><span id="yui_3_16_0_1_1453428722229_51023" style="mso-list:Ignore">5.<span id="yui_3_16_0_1_1453428722229_51025" style='font:7.0pt "Times New Roman"'> </span></span></span><span id="yui_3_16_0_1_1453428722229_51027" style='font-family:"Helvetica",sans-serif;color:black'>I also created a
SubjectContext as child of ProfileRequestContext, but not sure if it is needed
or not.</span></div>
<div id="yui_3_16_0_1_1453428722229_51029" style="margin: 0in 0in 0pt 0.5in; text-indent: -0.25in;"><span id="yui_3_16_0_1_1453428722229_51031" style='font-family:"Helvetica",sans-serif;mso-fareast-font-family:Helvetica;
mso-bidi-font-family:Helvetica;color:black'><span id="yui_3_16_0_1_1453428722229_51033" style="mso-list:Ignore">6.<span id="yui_3_16_0_1_1453428722229_51035" style='font:7.0pt "Times New Roman"'> </span></span></span><span id="yui_3_16_0_1_1453428722229_51037" style='font-family:"Helvetica",sans-serif;color:black'>Change the flow to
idp.authn.flows= dummy in idp.properties</span></div>
<div id="yui_3_16_0_1_1453428722229_51039" style="margin: 0in 0in 0pt 0.5in;"><span id="yui_3_16_0_1_1453428722229_51041" style='font-family:"Helvetica",sans-serif;
color:black'> </span></div>
<div id="yui_3_16_0_1_1453428722229_51043" style="margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_51045" style='font-family:"Helvetica",sans-serif;color:black'>Here
is my flow definition:</span></div>
<div id="yui_3_16_0_1_1453428722229_51047" style="margin: 0in 0in 0pt;"><span id="yui_3_16_0_1_1453428722229_51049" style='font-family:"Helvetica",sans-serif;color:black'> </span></div>
<div id="yui_3_16_0_1_1453428722229_51051" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51053" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51055" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51057" face="Calibri"><flow xmlns="</font><a id="yui_3_16_0_1_1453428722229_51059" href="http://www.springframework.org/schema/webflow"><font id="yui_3_16_0_1_1453428722229_51061" color="#0563c1" face="Calibri">http://www.springframework.org/schema/webflow</font></a><font id="yui_3_16_0_1_1453428722229_51063" face="Calibri">"</font></div>
<div id="yui_3_16_0_1_1453428722229_51065" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51067" face="Calibri"> xmlns:xsi="</font><a id="yui_3_16_0_1_1453428722229_51069" href="http://www.w3.org/2001/XMLSchema-instance"><font id="yui_3_16_0_1_1453428722229_51071" color="#0563c1" face="Calibri">http://www.w3.org/2001/XMLSchema-instance</font></a><font id="yui_3_16_0_1_1453428722229_51073" face="Calibri">"</font></div>
<div id="yui_3_16_0_1_1453428722229_51075" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51077" face="Calibri"> xsi:schemaLocation="</font><a id="yui_3_16_0_1_1453428722229_51079" href="http://www.springframework.org/schema/webflow%20http:/www.springframework.org/schema/webflow/spring-webflow.xsd"><font id="yui_3_16_0_1_1453428722229_51081" color="#0563c1" face="Calibri">http://www.springframework.org/schema/webflow
http://www.springframework.org/schema/webflow/spring-webflow.xsd</font></a><font id="yui_3_16_0_1_1453428722229_51083" face="Calibri">"</font></div>
<div id="yui_3_16_0_1_1453428722229_51085" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51087" face="Calibri"> parent="authn.abstract,
authn/conditions"></font></div>
<div id="yui_3_16_0_1_1453428722229_51089" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51091" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51093" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51095" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51097" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51099" face="Calibri"> <!-- Rudimentary impediment to direct
execution of subflow. --></font></div>
<div id="yui_3_16_0_1_1453428722229_51101" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51103" face="Calibri"> <input
name="calledAsSubflow" type="boolean"
required="true" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51105" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51107" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51109" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51111" face="Calibri"> <on-start></font></div>
<div id="yui_3_16_0_1_1453428722229_51113" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51115" face="Calibri">
<!-- Get authenticationcontext and usernamePassword context. we expect
usernamePassword context is null if we did not start with Password flow first
--></font></div>
<div id="yui_3_16_0_1_1453428722229_51117" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51119" face="Calibri"> <evaluate
expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))"
result="flowScope.authenticationContext" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51121" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51123" face="Calibri"> <evaluate
expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.UsernamePasswordContext))"
result="flowScope.usernamePasswordContext" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51125" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51127" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51129" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51131" face="Calibri">
<!--Create usernamecontext subcontext as child of authncontext, put jwang as
username --></font></div>
<div id="yui_3_16_0_1_1453428722229_51133" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51135" face="Calibri"> <evaluate
expression="flowScope.authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.UsernameContext),
true)" result="flowScope.usernameContext" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51137" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51139" face="Calibri">
<evaluate expression="flowScope.usernameContext.setUsername('jwang')"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51141" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51143" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51145" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51147" face="Calibri">
<!--Create subject with principals --></font></div>
<div id="yui_3_16_0_1_1453428722229_51149" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51151" face="Calibri">
<evaluate expression="new javax.security.auth.Subject()"
result="flowScope.subject" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51153" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51155" face="Calibri">
<evaluate expression="flowScope.subject.getPrincipals().add(new
net.shibboleth.idp.authn.principal.UsernamePrincipal(flowScope.usernameContext.getUsername()))"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51157" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51159" face="Calibri">
<evaluate expression="flowScope.subject.getPrincipals().add(new
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal('urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'))"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51161" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51163" face="Calibri">
<evaluate expression="flowScope.subject.getPrincipals().add(new
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal('urn:oasis:names:tc:SAML:2.0:ac:classes:Password'))"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51165" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51167" face="Calibri">
<evaluate expression="flowScope.subject.getPrincipals().add(new
net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal('urn:oasis:names:tc:SAML:1.0:am:password'))"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51169" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51171" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51173" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51175" face="Calibri">
<!--Create Authenresult with subject --></font></div>
<div id="yui_3_16_0_1_1453428722229_51177" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51179" face="Calibri">
<evaluate expression="new net.shibboleth.idp.authn.AuthenticationResult('authn/dummy',
flowScope.subject)" result="flowScope.authnResult" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51181" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51183" face="Calibri"> <evaluate
expression="flowScope.authenticationContext.setAuthenticationResult(flowScope.authnResult)"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51185" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51187" face="Calibri">
</font></div>
<div id="yui_3_16_0_1_1453428722229_51189" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51191" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51193" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51195" face="Calibri">
<!-- Create SubjectContext as child of ProfileRequestContext and add
authnresults and subject --></font></div>
<div id="yui_3_16_0_1_1453428722229_51197" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51199" face="Calibri"> <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectContext),
true)" result="flowScope.subjectContext" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51201" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51203" face="Calibri"> <evaluate
expression="flowScope.subjectContext.getAuthenticationResults()"
result="flowScope.authnResultMap" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51205" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51207" face="Calibri">
<evaluate expression="flowScope.authnResultMap.put(flowScope.authnResult.getAuthenticationFlowId(),
flowScope.authnResult)" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51209" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51211" face="Calibri">
<evaluate expression="flowScope.subjectContext.setPrincipalName(flowScope.usernameContext.getUsername())"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51213" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51215" face="Calibri">
</font></div>
<div id="yui_3_16_0_1_1453428722229_51217" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51219" face="Calibri">
<!-- Retrieve subjectCanonicalContext from Password flow--></font></div>
<div id="yui_3_16_0_1_1453428722229_51221" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51223" face="Calibri">
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectCanonicalizationContext))"
result="flowScope.subjectCanonicalContext" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51225" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51227" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51229" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51231" face="Calibri"> </on-start></font></div>
<div id="yui_3_16_0_1_1453428722229_51233" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51235" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51237" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51239" face="Calibri"> <!-- Display Dummy page --></font></div>
<div id="yui_3_16_0_1_1453428722229_51241" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51243" face="Calibri"> <view-state id="dummyView"
view="dummy"></font></div>
<div id="yui_3_16_0_1_1453428722229_51245" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51247" face="Calibri"> <on-render></font></div>
<div id="yui_3_16_0_1_1453428722229_51249" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51251" face="Calibri">
<evaluate expression="environment"
result="viewScope.environment" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51253" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51255" face="Calibri">
<evaluate
expression="flowRequestContext.getExternalContext().getNativeRequest()"
result="viewScope.request" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51257" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51259" face="Calibri">
</on-render></font></div>
<div id="yui_3_16_0_1_1453428722229_51261" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51263" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51265" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51267" face="Calibri"> <transition
to="dummyResponse" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51269" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51271" face="Calibri"> </view-state></font></div>
<div id="yui_3_16_0_1_1453428722229_51273" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51275" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51277" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51279" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51281" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51283" face="Calibri"> <action-state
id="dummyResponse"></font></div>
<div id="yui_3_16_0_1_1453428722229_51285" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51287" face="Calibri">
<!--Create SubjectCanonicalizationContext ></font></div>
<div id="yui_3_16_0_1_1453428722229_51289" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51291" face="Calibri">
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectCanonicalizationContext),
true)" result="flowScope.subjectCanonicalContext" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51293" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51295" face="Calibri">
<evaluate expression="flowScope.subjectCanonicalContext.setPrincipalName(flowScope.subjectContext.getPrincipalName())"
result="flowScope.subjectCanonicalContext" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51297" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51299" face="Calibri">
<evaluate expression="flowScope.subjectCanonicalContext.setSubject(flowScope.subject)"
result="flowScope.subjectCanonicalContext" /--></font></div>
<div id="yui_3_16_0_1_1453428722229_51301" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51303" face="Calibri">
<evaluate expression="'proceed'"/></font></div>
<div id="yui_3_16_0_1_1453428722229_51305" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51307" face="Calibri"> <!-- Proceed
on successful authentication --></font></div>
<div id="yui_3_16_0_1_1453428722229_51309" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51311" face="Calibri"> <transition
to="proceed" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51313" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51315" face="Calibri"> </action-state></font></div>
<div id="yui_3_16_0_1_1453428722229_51317" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51319" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51321" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51323" face="Calibri"> <end-state id="proceed"
/></font></div>
<div id="yui_3_16_0_1_1453428722229_51325" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51327" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51329" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51331" face="Calibri"></flow></font></div>
<div id="yui_3_16_0_1_1453428722229_51333" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51335" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51337" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51339" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51341" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51343" face="Calibri">My dummy.vm is nothing but a submit button:</font></div>
<div id="yui_3_16_0_1_1453428722229_51345" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51347" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51349" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51351" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51353" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51519" face="Calibri">
<form action="$flowExecutionUrl" method="post"></font></div>
<div id="yui_3_16_0_1_1453428722229_51521" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51523" face="Calibri">
<input type="text" name="_eventId_proceed"
value="transition" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51525" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51527" face="Calibri">
<button class="form-element form-button" type="submit"
name="_eventId_submit" value="submit"
>Submit</button></font></div>
<div id="yui_3_16_0_1_1453428722229_51529" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51531" face="Calibri">
</form></font></div>
<div id="yui_3_16_0_1_1453428722229_51533" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51543" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51545" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51547" face="Calibri">The error I got is InvalidSubectCanonicalizationContext:</font></div>
<div id="yui_3_16_0_1_1453428722229_51549" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51551" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51553" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51555" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51557" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51559" face="Calibri">2016-01-22 02:18:58,051 - DEBUG
[org.springframework.webflow.engine.SubflowState:99] - Calling subflow
'c14n/authn' with input map['calledAsSubflow' -> true]</font></div>
<div id="yui_3_16_0_1_1453428722229_51561" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51563" face="Calibri">2016-01-22 02:18:58,051 - DEBUG
[org.springframework.binding.mapping.impl.DefaultMapper:60] - Beginning mapping
between source [org.springframework.webflow.core.collection.LocalAttributeMap]
and target [org.springframework.webflow.engine.impl.RequestControlContextImpl]</font></div>
<div id="yui_3_16_0_1_1453428722229_51565" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51567" face="Calibri">2016-01-22 02:18:58,057 - DEBUG
[org.springframework.binding.mapping.impl.DefaultMapping:147] - Adding mapping
result [Success@39c9cc37 mapping = calledAsSubflow ->
flowScope.calledAsSubflow, code = 'success', error = false, originalValue =
true, mappedValue = true]</font></div>
<div id="yui_3_16_0_1_1453428722229_51569" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51571" face="Calibri">2016-01-22 02:18:58,057 - DEBUG
[org.springframework.binding.mapping.impl.DefaultMapper:69] - Completing
mapping between source
[org.springframework.webflow.core.collection.LocalAttributeMap] and target
[org.springframework.webflow.engine.impl.RequestControlContextImpl]; total
mappings = 1; total errors = 0</font></div>
<div id="yui_3_16_0_1_1453428722229_51573" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51575" face="Calibri">2016-01-22 02:18:58,057 - DEBUG
[org.springframework.webflow.engine.ActionState:189] - Entering state
'PopulateSubjectCanonicalizationContext' of flow 'c14n/authn'</font></div>
<div id="yui_3_16_0_1_1453428722229_51577" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51579" face="Calibri">2016-01-22 02:18:58,058 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:49] - Executing
[EvaluateAction@6f7e4c84 expression = PopulateSubjectCanonicalizationContext,
resultExpression = [null]]</font></div>
<div id="yui_3_16_0_1_1453428722229_51581" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51583" face="Calibri">2016-01-22 02:18:58,058 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:142]
- Putting action execution attributes map[[empty]]</font></div>
<div id="yui_3_16_0_1_1453428722229_51585" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51587" face="Calibri">2016-01-22 02:18:58,062 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:448] -
Creating instance of bean 'PopulateSubjectCanonicalizationContext'</font></div>
<div id="yui_3_16_0_1_1453428722229_51589" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51591" face="Calibri">2016-01-22 02:18:58,100 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:251] -
Returning cached instance of singleton bean
'shibboleth.PostLoginSubjectCanonicalizationFlows'</font></div>
<div id="yui_3_16_0_1_1453428722229_51593" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51595" face="Calibri">2016-01-22 02:18:58,105 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:1678] -
Invoking init method 'initialize' on bean with name
'PopulateSubjectCanonicalizationContext'</font></div>
<div id="yui_3_16_0_1_1453428722229_51597" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51599" face="Calibri">2016-01-22 02:18:58,110 - DEBUG
[org.springframework.beans.factory.support.DefaultListableBeanFactory:484] -
Finished creating instance of bean 'PopulateSubjectCanonicalizationContext'</font></div>
<div id="yui_3_16_0_1_1453428722229_51601" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51603" face="Calibri">2016-01-22 02:18:58,111 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:49] - Executing </font><a id="yui_3_16_0_1_1453428722229_51605" href=""><font id="yui_3_16_0_1_1453428722229_51607" color="#000000" face="Calibri">net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext@47879616</font></a></div>
<div id="yui_3_16_0_1_1453428722229_51609" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51611" face="Calibri">2016-01-22 02:18:58,111 - DEBUG
[org.springframework.webflow.execution.ActionExecutor:53] - Finished executing </font><a id="yui_3_16_0_1_1453428722229_51613" href=""><font id="yui_3_16_0_1_1453428722229_51615" color="#000000" face="Calibri">net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext@47879616</font></a><font id="yui_3_16_0_1_1453428722229_51617" face="Calibri">;
result = InvalidSubjectCanonicalizationContext</font></div>
<div id="yui_3_16_0_1_1453428722229_51619" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51733" face="Calibri"></font><br></div>
<div id="yui_3_16_0_1_1453428722229_51735" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51737" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51739" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51741" face="Calibri">The Shibboleth document says that upon successful
authentication, a SubjectCanonicalizationContext object should be created and
passed on to the Subject Canonicalization subflow. So my question is that how I
can create the SubjectCanonicalizationContext object? I looked at the samples
in the document page </font><a id="yui_3_16_0_1_1453428722229_51743" href="https://wiki.shibboleth.net/confluence/display/IDP30/Contributions+and+Extensions"><font id="yui_3_16_0_1_1453428722229_51745" color="#0563c1" face="Calibri">https://wiki.shibboleth.net/confluence/display/IDP30/Contributions+and+Extensions</font></a><font id="yui_3_16_0_1_1453428722229_51747" face="Calibri">,
but none of them seems to have a step to create the
SubjectCanonicalizationContext. </font></div>
<div id="yui_3_16_0_1_1453428722229_51749" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51751" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51753" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51755" face="Calibri">I also tried to add the above authentication flow as a
subflow of the authn/Password flow by modifying the conditions-flow.xml:</font></div>
<div id="yui_3_16_0_1_1453428722229_51757" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51759" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51761" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51763" face="Calibri"> <action-state
id="ValidateUsernamePassword"></font></div>
<div id="yui_3_16_0_1_1453428722229_51765" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51767" face="Calibri"> <evaluate
expression="ValidateUsernamePassword" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51769" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51771" face="Calibri"> <evaluate
expression="'dummy'" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51773" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51775" face="Calibri"> <transition
on="dummy" to="dummyAuth" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51777" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51779" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51781" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51783" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51785" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51787" face="Calibri"> <subflow-state id="dummyAuth"
subflow="authn/dummy"></font></div>
<div id="yui_3_16_0_1_1453428722229_51789" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51791" face="Calibri"> <input
name="calledAsSubflow" value="true" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51793" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51795" face="Calibri"> <transition
on="proceed" to="proceed" /></font></div>
<div id="yui_3_16_0_1_1453428722229_51797" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51799" face="Calibri"> </subflow-state></font></div>
<div id="yui_3_16_0_1_1453428722229_51801" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51803" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51805" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51807" face="Calibri">If I do that, I then successfully passed and everything
worked fine. So the authn/Password flow must have created the
SubjectCanonicalizationContext successfully, but I do not know how to do that
if I run my standalone authn/dummy sublow.</font></div>
<div id="yui_3_16_0_1_1453428722229_51809" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51811" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51813" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51815" face="Calibri">I am running Shibboleth idp 3.2.1 on Jetty 9.2.</font></div>
<div id="yui_3_16_0_1_1453428722229_51817" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51819" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51821" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51823" face="Calibri">Any help would be greatly appreciated.</font></div>
<div id="yui_3_16_0_1_1453428722229_51825" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51827" face="Calibri"> </font></div>
<div id="yui_3_16_0_1_1453428722229_51829" style="margin: 0in 0in 0pt;"><font id="yui_3_16_0_1_1453428722229_51831" face="Calibri">Thanks, Joey</font></div>
<div id="yui_3_16_0_1_1453428722229_51833" style="margin: 0in 0in 0pt;" dir="ltr"><font id="yui_3_16_0_1_1453428722229_51835" face="Calibri"> </font></div>
</div></body></html>