How to terminate MFA flow with an error?

[Losen, Stephen C. (scl)]

Following up my previous email, I tried returning "DuoSignup" from the MFA transition map and the IDP apparently insists on it being a flow name.  The IDP displayed this error on my browser:

Uncaught Exception

A software error was encountered that prevents normal operation:

org.springframework.webflow.definition.registry.NoSuchFlowDefinitionException: No flow definition 'DuoSignup' found


And this was in idp-process.log:

2018-05-18 11:55:23,123 137.54.130.16 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception
org.springframework.webflow.definition.registry.NoSuchFlowDefinitionException: No flow definition 'DuoSignup' found
        at org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl.getFlowDefinitionHolder(FlowDefinitionRegistryImpl.java:123)
2018-05-18 11:55:23,133 137.54.130.16 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RuntimeException

I did define "DuoSignup" in conf/authn/authn-events-flow.xml

Looks like I need to use a context check intercept.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Losen, Stephen C. (scl)
Sent: Friday, May 18, 2018 11:50 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: How to terminate MFA flow with an error?

Thanks again, Scott.

I was confused because the IDP redirected me back to the SP.  I mistakenly thought that defining the event in authn-events-flow.xml was enough to prevent that.  But now I see that behavior is controlled in errors.xml in "shibboleth.LocalEventMap".

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, May 18, 2018 11:00 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: How to terminate MFA flow with an error?

> So the MFA transition map should return the string "authn/MyEvent"? And in
> conf/authn/authn-events-flow.xml should I have "authn/MyEvent" or just
> "MyEvent" ?  Same for conf/errors.xml ?

"MyEvent". "authn/Whatever" is an actual event name, it just happens to use a convention to recognize that it's a flow ID and there are special rules in the flows for doing things in response to those strings:

        <transition on="#{currentEvent.id.startsWith('authn/')}" to="ReselectFlow">

-- Scott

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net