reCaptcha integration with IDPv3

[Cantor, Scott]

> My target is to use the built-in LDAP user-password authn flow,
> without writing code that requires compiling, nor touching the system files.

Well, the general assumption is that if you're doing unusual things, you need a custom login flow. Trying to reuse the ones that are provided but make them do more than they do is generally hard unless there are specific extension points to do something. But the one you found is certainly public.

> It's required to prevent robots from learning anything about the credential.

At the cost of users running you over if they find out who added the captcha? ;-)

> I've considered using extended flow of the UserPassword module,
> but that seems to fail to meet the requirement above.

No, it isn't at all the same thing, it's to run something instead of the password option, not in addition to it.

> Finally, I found a way to accomplish it, but in a quite tricky manner:

That's clever.

> Although this method doesn't touch the files under the `system' folder,
> it is so subtle so that I suspect it be subject to change with future releases of
> IDP.
> Is there any better way?

Other than writing a custom flow by copying the provided ones (and that would include copying the code because the actual beans are not public APIs), I can't imagine a better way.

The conditions feature in the password flow is currently the only real case of attempting to support a direct extension of a flow's behavior in that manner. As such, it hasn't gotten a lot of testing or use yet, but the content of the conditions-flow file is essentially a public API. I don't think there's anything you can do in terms of manipulating the action-state that would be at risk until 4.0 at the earliest.

I think the "riskier" aspect is the manipulation of the context tree in that particular way. That isn't public. In the scheme of things, that's pretty unlikely to change. But no, I can't promise it.

-- Scott