NoSuchFlowExecution after multiple redirects in External Auth Flow

[Aravinda Liyanage]

Hello Team,

I am trying to use the External Authentication flow
<https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631607/ExternalAuthnConfiguration>
and upon receiving the initial request to my custom servlet, it goes
through multiple redirects in our internal system and eventually redirects
to the same servlet. However at this point, it is unable to find a flow by
using the conversation key.
This works fine if, *finishExternalAuthentication* is called initially
without any redirects.

Is the flow context resolution solely based on the conversation key or are
there any other things that need to be maintained or propagated? I had a
look at the data structure by debugging and clearly see the conversation
list is empty.

Here is my sample code.

@Override
protected void doGet(HttpServletRequest request, HttpServletResponse
response) throws IOException {

    String conversationKey = request.getParameter("conversation-key");
    log.info("Received request at SAML handler: {}, conversationKey:
{}", request.getRequestURL().toString(),conversationKey);

    if (conversationKey == null) {

       try {
          conversationKey =
ExternalAuthentication.startExternalAuthentication(request);
       } catch (ExternalAuthenticationException e) {
          log.info("ExternalAuthenticationException occurred while
starting external authentication", e);
          throw new RuntimeException(e);
       }

       // Store any needed SAML parameters
       request.getSession().setAttribute("conversation-key", conversationKey);

       // Redirect to your external authentication system
       String redirectUri = ssoIdpConnectorServiceUrl +
"/connect/auth?conversation-key=" + conversationKey;
       redirectUri += "&redirect_uri=" +
URLEncoder.encode(callBackHost +
"/idp/auth/saml-handle?conversation-key=" + conversationKey,
             StandardCharsets.UTF_8);

       log.info("Redirecting to {}", redirectUri);
       response.sendRedirect(redirectUri);

    } else {
       // Create the Subject object (representing the authenticated user)
       Subject subject = new Subject();
       subject.getPrincipals().add(new UsernamePrincipal("user123"));

       // Attach the Subject to the request
       request.setAttribute(ExternalAuthentication.SUBJECT_KEY, subject);

       try {
          ExternalAuthentication.finishExternalAuthentication(conversationKey,
request, response);
          log.info("Completed external authentication");
       } catch (ExternalAuthenticationException e) {
          throw new RuntimeException(e);
       }
    }
}

[image: Screenshot 2025-04-04 at 12.06.44 PM 2.jpg]

Appreciate any thoughts on this.
Thank you

-- 
Best Regards,
Aravinda Madushanka.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250404/6c81ed19/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot 2025-04-04 at 12.06.44?PM 2.jpg
Type: image/jpeg
Size: 86727 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20250404/6c81ed19/attachment.jpg>