Event transition issue for IdP 3.3.1

[O'Dowd, Josh]

> I think you should simply do it afterwards and not try and re-validate the credentials like that. If they already logged in and it worked, and it's not an expired password, have them change it, but why re-validate it?

I can't remember, but I may have done the re-validation in an attempt to trigger the c14n that occurs "naturally" at the end of the password-authn-flow.

> But regardless, I don't know what it's not working, you would have to compare things. ValidateUsernamePassword is still a valid state. Perhaps you're just not transitioning to it correctly.
Well, I am pretty sure we tested that it was working in 3.3.0.  I will share the transition snippet from expiring-password-flow:

    ...
    password change form present
    ....

    <transition on="submit" to="doValidateUsernamePassword">
                <evaluate expression="NetIdUserSecurityFormAction.bindAndValidate"/>
                <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.UsernamePasswordContext))" result="flowScope.upc" />
                <evaluate expression="upc.setPassword(flowScope.get(formName).password)" />             
    </transition>
    </view-state> <!-- End of Password change form view-state -->
    
    <action-state id="doValidateUsernamePassword">
        <evaluate expression="'proceed'" />
        <transition to="ValidateUsernamePassword" />
    </action-state>
         
    <action-state id="doC14N">
                <evaluate expression="ManualC14N" />
                <transition on="success" to="proceed" />
                <transition on="error" to="SubjectCanonicalizationError" />
    </action-state>
    
    <end-state id="proceed" />
    <end-state id="ValidateUsernamePassword" />    
    <end-state id="SubjectCanonicalizationError" />

Now that I look at this, months later.  It is pretty ugly and certainly not right.  My guess is that the Validate.. end-state is causing an event transition issue due to the 3.3.1 changes, and I should omit that.  But, furthermore, I should probably start over with the submit transition anyway.

-Josh