IDP3 authn intercept question

[Cantor, Scott]

On 9/30/15, 12:00 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

>Good Morning,
> 
>We have a post-authn intercept with a flow that provides a user form.  When the intercept-flow is engaged, authentication has already been achieved.  In other words if the user ignores the form and navigates to the service page,  they would already have a session.

What service page are you referring to? The only session they have is with the IdP. They can't ignore the intercept with respect to an SP.

> 
>What we want to do is complete the authenticated redirect ONLY if the user successfully submits the form presented by our intercept-flow.

Any intercept works like that. If it doesn't signal a "proceed" as the result of the subflow, the IdP won't issue an assertion, it will stop there with an error.

> 
>So, for this purpose, can we then safely negate the authentication until the form is done, by removing the AuthenticationResult from the AuthenticationContext, and the Subject from the SubjectCanonicalizationContext?  

Certain things will break in unreliable and unpredictable ways, but that's not the right approach.

-- Scott