Advice on migrating SPNEGO to MFA-flow

[Philip Brusten]

On 11/01/2017 15:43, Cantor, Scott wrote:
> On 1/11/17, 6:02 AM, "users on behalf of Philip Brusten" <users-bounces at shibboleth.net on behalf of philip.brusten at kuleuven.be> wrote:
>
>> MFA starts SPNEGO flow, but I cannot catch the event "ReselectFlow", so
>> I end up with the event "NoPotentialFlow".
> I know that (now) two people have claimed this, but I haven't found any code that should make handling that event any different than any other.
>
> Are you sure that's the event here? It's not SPNEGONotAvailable?
Finally, I found the problem...
My TransitionMap was not set up to catch the events, now it all works 
using this TransitionMap (rtfm....)

     <util:map id="shibboleth.authn.MFA.TransitionMap">
         <entry key="">
             <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlowStrategy-ref="selectFirstFactor" />
         </entry>

         <entry key="authn/SPNEGO">
             <bean parent="shibboleth.authn.MFA.Transition">
                 <property name="nextFlowStrategyMap">
                     <map>
                         <entry key="ReselectFlow" value="authn/Password" />
                         <entry key="proceed" 
value-ref="checkSecondFactor" />
                     </map>
                 </property>
             </bean>
         </entry>

         <entry key="authn/Password">
             <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlowStrategy-ref="checkSecondFactor" />
         </entry>

         <!-- An implicit final rule will return whatever the final flow 
returns. -->
     </util:map>

I was in the assumption that 'ReselectFlow' had to be an entry in the 
TransitionMap, which makes no sense of course.
Thanks for the guidance, I'm glad it's resolved now.

Kr,

Philip