Multiple instances of the same authentication flow on Shibboleth IdP

[Guillaume Rousse]

Hello.

We have a use case where we would like to use multiple instances of the 
same authentication flow, with different parameters, on Shibboleth IdP.

For instance, with an hypothetical XXX flow:

idp.authn.flows = XXX1|XXX2

# multiple second factors allowed
idp.authn.XXX1.supportedPrincipals =
   class1, class2, class3
idp.authn.XXX1.otherProperty = foo,bar,baz

# only hardware-based second factors allowed
idp.authn.XXX2.supportedPrincipals =
   class3
idp.authn.XXX2.otherProperty = baz

That's just an example, as the actual decision to use either XXX1 or 
XXX2 would be probably be done with MFA flow, using a scripted 
transition strategy, but that's probably easier to read.

I've found the list of flow descriptors here:
https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml;h=042a20d07571df98662e618a0e5c28bb443d1ca0;hb=HEAD

But I don't see any explicit mapping between a flow identifier (ie, 
authn/Password) and a specific class name, or any other kind of java 
object, that would allow the same piece of code to be instanciated 
multiple times with different identifiers, allowing multiple parameters 
sets (ie, authn/Password1, authn/Password2, ...). Am I correct assuming 
each flow auto-register itself with an hardcoded identifier, and won't 
work if configured with anything else ?

As a side note, I've noticed two flow pairs that seems to be closely 
related to my use case, but I'm unable to figure if the difference are 
actually implemented in different code base, or if it just 
configuration-based:
- X509 vs X509internal
- RemoteUser vs RemoteUserInternal

Regards.
-- 
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2809 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20250319/08e713e2/attachment.p7s>