login within a login

[Jim Fox]

This login within a login works.  Can I count on it in the future?

1) Someone clicks a link to a google doc connected to UW's google domain.

2) Google redirects her to our IdP.

3) She authenticates.  However, if she doesn't already have a google account in our domain (not sure of terminology) 
returning to google won't do much good. so..

4) A post-authn intercept verifies user has the proper google account.  If not..

5) Invokes a sub-flow to redirect user to a maintenance site where she can obtain one.  That site is itself protected by shib, so..

6) User is redirected from maintenance site to our IdP for login.

7) That succeeds, as the authn part of the original login has completed.

8) IdP redirects user to maintenance site where she acquires proper google account.

9) Maintenance site redirects user back to IdP (url gleaned from step 5 query params).

10) IdP completes original request (step 2) and redirects user to google doc.

Note that the 'inside' login has a different execution id.  And I added a "_eventId_proceed=1" to the redirect url (step 9).  Is that too much of using an undocumented api?


Jim