How to restart authentication in a postAuthenticationFlow

[cneberg]

That sounds just like what I need.  Thank you.

-Christopher

On Thu, Feb 11, 2016 at 2:44 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Scott et al, per our conversation earlier today.   I created a JIRA
> ticket
> > https://issues.shibboleth.net/jira/browse/IDP-921.  Is there any method
> I
> > could run when authz fails as part of postAuthenticationFlows to
> re-trigger
> > authentication?   If possible I'd also like to include a specific
> minimum authz
> > level as a hint.
>
> The only existing way is to wire in a call to the authn subflow to
> directly re-invoke all of it. But I think that will be more error prone
> than building in a way to do this so that the profiles will just do it for
> you if you signal a particular event back. But that will require rewiring
> them to recognize the event.
>
> In either case, there has to be clear documentation (which there now
> isn't) on what you have to do to the tree to ensure it all works correctly,
> including deleting existing contexts from the previous run (e.g. the
> AttributeContext).
>
> If we rewire it with the assumption that the tree is set up by the code
> that signals the event, then the profiles won't stomp on the tree to re-run
> the authn flow, which means it will operate based on whatever is in the
> RequestedPrincipalContext your code chooses to populate. That means you can
> control the selection process for the subsequent run, but with the caveat
> that you could end up violating rules imposed by the original request if
> you overwrite what the IdP pulled out of the AuthnRequest to use. The
> cross-check of the result is based on what's in that context, not what's
> actually in the AuthnRequest. It assumes nobody is screwing with the data
> deliberately.
>
> I will outline a few things we need to do in the Jira issue.
>
> The flow re-wiring should only involve system file changes, so it will be
> easy enough to pre-apply them if you wanted to.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160211/f3d2a374/attachment.html>