Principal Adding

[Cantor, Scott]

It bears noting almost all of this is irrelevant now. Anybody even thinking of manipulating this stuff should be using a snapshot and just start working with the MFA flow directly. That is safer than using a released version and playing with these tricky settings.
 
> I can't figure out what "addDefaultPrincipals" on validate action beans does.  I
> tried setting it forcibly to false for the password flow validator for LDAP,
> which I assumed would result in wonky login failures because the Principal
> wouldn't get added, but it seems to be working as unintended.

The purpose of the setting is to prevent it from just putting everything defined in the flow's supportedPrincipals property (the stuff in general-authn.xml) into the Subject. Turning it off means that the flow itself has some kind of dynamic behavior you need to preserve, e.g. using the External flow and providing the right set of Principals from outside the IdP so you don't want it to override that choice.

If you turn it off, the Password flow's Validators shouldn't be adding anything but probably the UsernamePrincipal, and whatever else they inherently do themselves, or there's something unusual going on that's overriding the setting.

> What's the point of Principals on validators, and why would you declare it
> there rather than in the flows?  Recycling?  The only good way to pass things
> in to the class?

It's to support building flows that chain validators together that do different things acting on the same inputs. The basic reason it's there is that when you use RSA SecurID, that's not like Duo, it's real MFA in one step and it looks the same as checking a password does. So the code that's doing the check has to know whether a successful result should result in a password context or an MFA context, and it has to know whether it should even run. Telling the validator bean what it supports allows it to evaluate itself against the request to know whether it's allowed to run (e.g. request MFA, the Password validator won't run) and if it does run, what to produce.

When I used it, I told the Password flow to "support" both PPT and TimeSyncToken, but depending on the request, not all of the validators ran. In point of fact, I didn't end up using it, at least not in that way, but that was the underlying idea. There's a ton of complex JAAS stuff added also that I used briefly and have now dumped.

It has all generally been a messy failure and is now historical other than as a lot of complex tooling available to sombody working on their own flow, which nobody needs to do anymore since the MFA flow takes care of all these use cases more elegantly and with less trickery.

Run the snapshot and move on. Upgrading from snapshots to the final will be 99% of the time a simple install and restart. I can't promise that, but the work to correct anything that breaks in the next 6 weeks is dwarfed by the work to avoid using the features it adds.

-- Scott