support ExternalAuthnConfiguration as well as Password Flow at the same time.

[abdul waheed]

Thanks Scott for all the help, I read the Authentication flow and got the
basic idea of how authenticationFlow get decided.



but I am still stuck at the same part i.e. trigger particular flow from SP.
Here is what all I tried.

1.  Added all the required flows idp.authn.flows=Password|Facebook|Google,
Registered the bean in general-authn.xml file, added new Servlet entry in
Web.xml file and added multiple metadata for each flow in
Shibboleth2.xml file. When I hit any Idp from discovery URL it always
choose Password flow which is normal behaviour, later I updated the URL
from idp/profile/SAML2/Redirect/SSO to
idp/authn/facebook?conversation=facebook in one of the Metadata's file and
when I select particular Idp, It goes to external authn flow but see error
as No conversation state found in session for key (facebook).



2. Second I looked into the ShibRequestSetting authnContextClassRef
 urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken,I added this
attribute in our virtual host and updated general-authn.xml file and seems
like it solves the issue but one vhost can point to one login flow but I
want all the flow should be enabled for the same vhost.



3. I read about SessionInitiator tag i.e. I have added below snippet into
Shibboleth2.xml file but this property is getting set for each entity Id
that I have registered not to the particular entityID that I mentioned in
tag.

                                    <SessionInitiator type="SAML2"
isDefault="true" Location="/Login" entityID="
https://idp.domain.com/idp/facebook"
authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken"
authnContextComparison="exact"/>



I had an internal discussion as well about upgrading IdP 3.2.1 to 3.3 and I
read about ExternalAuthnPathStrategy i.e.
  As of V3.3, you may dynamically derive the path to use, typically so that
it can vary based on aspects of the request, by defining a bean named
shibboleth.authn.External.externalAuthnPathStrategy of type
Function<ProfileRequestContext,String>

But I am not sure how to use it to get my requirement.



Please let me know if you think by upgrading I can get my solution easily
or by doing some changes to my current setup or point me something which I
am missing in above 3 points.



On Thu, Mar 2, 2017 at 8:11 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Thanks Scott, I've searched on net but didn't get much detail for
> multiple
> > login flow. Can you point me to any reference if you are aware of ?
>
> I already pointed you at the documentation explaining how the IdP chooses
> which flow to try.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170309/e69806f1/attachment.html>