Session Lifetime of constituent flows in MFA

[John Watt]

This was great, Scott, thanks. I think​ this is working now, the code itself to do a results check first was quite straightforward, just terminating the flow does indeed reuse an existing result.

However, I'll admit to the best part of a week spent wondering why my authn/SAML results kept disappearing irrespective of its lifetime setting in the bean (PT10M), and seemed to be entirely dependent on the defaultLifetime property (PT5M).

The only way I could get them to persist was to set a lifetime for the MFA flow itself of at least as long as the SAML lifetime. This allowed the SAML flow to outlive the defaultLifetime and obey its bean override - setting the MFA lifetime to longer than the SAML one shows the SAML flow result disappearing after its own specified lifetime.

This is probably obvious, but is this because the MFAContext needs to be live in order to extract the results of the individual flows it calls? (so if the MFA lifetime was less than the SAML one, the SAML result would disappear along with it?) I was maybe being a bit too careless with the MFA flow as I'd set it to reuseCondition=false, and spent too long trying to work out if there was something wrong with beans/property settings!

Thanks for the help again.
John
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: 04 March 2022 16:55
To: Shib Users <users at shibboleth.net>
Subject: Re: Session Lifetime of constituent flows in MFA

On 3/4/22, 11:44 AM, "users on behalf of John Watt" <users-bounces at shibboleth.net on behalf of John.Watt at glasgow.ac.uk> wrote:

>    For context, my MFA flow consists of a custom flow which renders a page that allows the user to select
> either SAML or LDAP login flows via a button click. I'll have a look at reuseCondition but I assume this custom
> flow selection page will need some way of remembering its previous result, or the selection page will be
> rendered again for user interaction regardless of the subsequent lifetimes of any flows it invokes.

You could probably impose a script that interrogates the MultiFactorAuthenticationContext's activeResults collection. That's where the child result(s) will be if they exist. That might just let you bypass the chooser and have it "run"whichever flow was active, which will just cause it to reuse that result. In fact just terminating the MFA flow outright there is probably equivalent to that. If your script returns null, it will basically just package up whatever is there as the new set of results, effectively reusing them all automatically.

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220311/99b041fe/attachment.htm>