<div dir="ltr"><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr"><div><p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">Thanks Scott for all the help, I read the Authentication flow and got the basic idea of how authenticationFlow get decided.<span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt"><span> </span></span></p>
<p class="MsoNormal" style="margin-bottom:12pt;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">but I am still stuck at the same part i.e. trigger particular flow from SP. Here is what all I tried.<span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">1. Added all the required flows <span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;background-color:yellow">idp.authn.flows=Password|Facebook|Google</span>, Registered the bean in <span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;background-color:yellow">general-authn.xml</span> file, added new <span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;background-color:yellow">Servlet entry in Web.xml</span> file and added multiple metadata for each flow in Shibboleth2.xml file. When I hit any Idp from discovery URL it always choose Password flow which is normal behaviour, later I <span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;background-color:yellow">updated the URL from idp/profile/SAML2/Redirect/SSO to idp/authn/facebook?conversation=facebook</span> in one of the Metadata's file and when I select particular Idp, It goes to external authn flow but see error as No conversation state found in session for key (facebook).<span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt"><span> </span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">2. Second I looked into the <span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;background-color:yellow">ShibRequestSetting authnContextClassRef urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</span>,I added this attribute in our virtual host and updated general-authn.xml file and seems like it solves the issue but one vhost can point to one login flow but I want all the flow should be enabled for the same vhost.<span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt"><span> </span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">3. I read about SessionInitiator tag i.e. I have added below snippet into Shibboleth2.xml file but this property is getting set for each entity Id that I have registered not to the particular entityID that I mentioned in tag.<span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt"> <span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;background-color:yellow"><SessionInitiator type="SAML2" isDefault="true" Location="/Login" entityID="<a href="https://idp.domain.com/idp/facebook">https://idp.domain.com/idp/facebook</a>" authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken" authnContextComparison="exact"/></span><span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt"><span> </span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">I had an internal discussion as well about upgrading IdP 3.2.1 to 3.3 and I read about ExternalAuthnPathStrategy i.e.<br> </span><span class="gmail-MsoIntenseEmphasis">As of V3.3, you may dynamically derive the path to use, typically so that it can vary based on aspects of the request, by defining a bean named shibboleth.authn.External.externalAuthnPathStrategy of type Function<ProfileRequestContext,String><span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">But I am not sure how to use it to get my requirement.<span></span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt"><span> </span></span></p>
<p class="MsoNormal" style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"><span style="font-size:12pt">Please let me know if you think by upgrading I can get my solution easily or by doing some changes to my current setup or point me something which I am missing in above 3 points.<span></span></span></p></div><div><br><br></div></div></div></div>
<br><div class="gmail_quote">On Thu, Mar 2, 2017 at 8:11 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">> Thanks Scott, I've searched on net but didn't get much detail for multiple<br>
> login flow. Can you point me to any reference if you are aware of ?<br>
<br>
</span>I already pointed you at the documentation explaining how the IdP chooses which flow to try.<br>
<div class="gmail-HOEnZb"><div class="gmail-h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div></div>