Multi-Context Broker functionality in Shibboleth v3 - Comments please.

[David Walker]

On 04/23/2015 01:25 PM, Cantor, Scott wrote:
> On 4/23/15, 6:33 PM, "David Walker" <dhwprof at gmail.com> wrote:
>
>
>> So, in 
>> https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfigu
>> ration it says:
> I added that yesterday in response to the conversation here.

Thanks!

>> Am I right in assuming that if a site configures authentication flows to 
>> return "ReselectFlow", rather than failure, then David Bantz would get 
>> the effect he wants?  That is, the IdP would continue to prompt the user 
>> for authentication and not return to the SP?
> No. That causes it to move on to the next eligible login method to 
> attempt, and if there is none, it fails (either locally or with a response 
> to the SP). It isn't going to keep retrying failed methods.
>
> People using password forms never leave that particular flow. They keep 
> entering passwords and it keeps returning an error, endlessly, just like 
> today and on pretty much every login interface one sees.

So, I guess we need the last paragraph of that Flow Cancellation
section:  "You can take advantage of that machinery to include a button
or link a user can click to signal a custom (or built-in) event ID and
then you can choose how to handle that event as the overall result of
the authentication process with either a local error handling view or by
returning control to a requesting service (see the
ErrorHandlingConfiguration topic for a discussion of error event
handling)," right?

This also raises the question that I asked a couple of days ago, whether
we need this capability across all authentication flows, or if it's
really only needed for certain flows (perhaps only username/password?). 
David Bantz and others, care to weight in?

>> Adding a "Get me out of here!" button that returns failure would address 
>> the original intent of the MCB's counter, but it wouldn't be necessary.
> Yes, it addresses that kind of case.
>
> -- Scott
>