Missing configuration related to activation flow

[Aravinda Liyanage]

Hello Team,

We are currently implementing a use case where Shibboleth IdP (v5.1.3)
serves as a SAML termination point, enabling integration with existing
internal SSO services and allowing us to reuse established authentication
infrastructure.
We managed to put together the following configuration by following
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369/ExternalAuthnConfiguration
and rest of the documentation.

authn.properties >>
idp.authn.flows = "ExternalAuthFlow"

authn-comparison.xml >>

<util:list id="shibboleth.AvailableAuthenticationFlows">
    <bean id="authn/ExternalAuthFlow" parent="shibboleth.AuthenticationFlow"
         p:passiveAuthenticationSupported="false"
         p:forcedAuthenticationSupported="false"
         p:nonBrowserSupported="false">
       <property name="supportedPrincipals">
          <list>
             <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"/>
          </list>
       </property>
    </bean>
</util:list>

relying-party.xml >>

<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
    <property name="profileConfigurations">
        <list>
          <ref bean="SAML2.SSO" />
        </list>
    </property>
</bean>

<util:list id="shibboleth.RelyingPartyOverrides">
<bean parent="RelyingPartyByName" c:relyingPartyIds="second-service-provider">
    <property name="profileConfigurations">
       <list>
          <bean parent="SAML2.SSO"
               p:authenticationFlows="#{{'authn/ExternalAuthFlow'}}"
               p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'}}"/>
          </list>
    </property>
</bean>

</util:list>

flows/authn/ExternalAuthFlow.xml

<action-state id="externalAuthentication">
    <bean-action bean="ExternalAuthAction" method="execute">
       <result name="proceed" next="redirectExternal"/>
       <result name="failure" next="authenticationFailure"/>
    </bean-action>
</action-state>

<view-state id="redirectExternal"
model="flowScope.externalRedirectUrl" view="externalRedirectView">
    <transition on="proceed" to="end"/> <!-- Should not happen from
this view state directly -->
</view-state>

<action-state id="callbackAuthentication">
    <bean-action bean="HandleCallbackAction" method="execute">
       <result name="proceed" next="authenticationSuccess"/>
       <result name="failure" next="authenticationFailure"/>
    </bean-action>
</action-state>

<end-state id="authenticationSuccess" commit="true">
    <output attribute="authnResult" value="flowScope.authenticationResult"/>
</end-state>

<end-state id="authenticationFailure" commit="false">
    <output attribute="authnException"
value="flowScope.authenticationException"/>
</end-state>

global.xml

<bean id="ExternalAuthAction"
      class="com.samples.ExternalAuthAction"
      scope="prototype"
      p:httpServletRequest-ref="shibboleth.HttpServletRequest"
      p:httpServletResponse-ref="shibboleth.HttpServletResponse"/>

// another bean called HandleCallbackAction

Implementation classes
ExternalAuthAction extends AbstractAuthenticationAction{
//final String conversationKey =
ExternalAuthentication.startExternalAuthentication(request);

//pause context and redirect to internal SSO service

}
HandleCallbackAction extends AbstractAuthenticationAction{
 // receive call back from internal SSO service after login

// respond to the original request

}

Sample request

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"

AssertionConsumerServiceURL="http://localhost:8083/this-is-sp2/saml/sso/second-service-provider"

Destination="https://localhost/idp/profile/SAML2.SSO/Redirect/SSO"
                 ForceAuthn="false"
                 ID="ARQ0e142d5-1074-45ee-b749-f71b7937d61e"
                 IsPassive="false"
                 IssueInstant="2025-03-20T18:22:15.663Z"

ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                 Version="2.0">
    <saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">second-service-provider</saml2:Issuer>
</saml2p:AuthnRequest>


Upon debugging the code, I noticed `authn/ExternalAuthFlow` is
populated as an active authentication flow but it doesn't see it as a
potential flow inside the PopulateAuthenticationContext class.

2025-03-26 17:36:14,289 - 172.17.0.1 - WARN
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:201] -
Profile Action PopulateAuthenticationContext: No authentication flows
are active for this request
2025-03-26 17:36:17,817 - 172.17.0.1 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:313] - Profile
Action SelectAuthenticationFlow: No potential flows left to choose
from, authentication failed

Does this sound like a feasible solution? Appreciate if someone could point
me in the right direction on resolving the configuration.
PS. I have to admit that I am in the early stages of exploring SAML.

-- 
Best Regards,
Aravinda Madushanka.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250326/074b1e1f/attachment.htm>