Event transition issue for IdP 3.3.1

[Cantor, Scott]

> I can't remember, but I may have done the re-validation in an attempt to
> trigger the c14n that occurs "naturally" at the end of the password-authn-
> flow.

But that's not going to be impacted by changing the password. I'm saying, use an interceptor after the fact.

> Well, I am pretty sure we tested that it was working in 3.3.0.  I will share the
> transition snippet from expiring-password-flow:

The problem is the end state. The security fix in 3.3.1 is that it no longer just auto-transitions. Your subflow is ending with ValidateUsernamePassword, and prior to the fix, that end state caused the calling flow to transition to that state. It no longer does that for you, if you want that to happen you would have to add a transition rule to the conditions flow itself inside the CallExpiringPassword state so that it handles that event and not just proceed.

So it's doable, it's a bug in your original config that was taking advantage of a shortcut we had to remove.

-- Scott