<div dir="ltr">The goal of the custom flow is to provide a choice between 2 authentication:<div>- external one</div><div>- authentication against LDAP with provide credentials.</div><div>The same webpage is used to trigger either external authentication either ldap one.</div><div>After LDAP/External authentication, we use an http call to a Rest API to get information about username and so populate saml response through attribute-resolver mechanism.</div><div><br></div><div>To achieve this, we didn't tweak completely the current file but added some custom flow that are very similar to the existing one:</div><div>We got a xxx-particulier-ldap-authn-config.xml and a xxx-particulier-password-authn-config.xml nearly identical to the ldap-authn-config.xml and password-authn-config.xml.</div><div>We have got a specific spring webflow for this auth flow. This is this flow which is using the </div><div><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(232,191,106)">/></span> which is mapped to the ValidateUsernamePasswordAgainstLDAP in IDP3. <br></div><div>I'm not sure if it was really needed to redefine the whole flow or if we could have just tweaked the existing one.</div><div>Regards,</div><div>Claude</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mer. 5 mai 2021 à 15:45, Claude Libois <<a href="mailto:clibois.work@gmail.com">clibois.work@gmail.com</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">The goal of the custom flow is to provide a choice between 2 authentication:<div>- external one</div><div>- authentication against LDAP with provide credentials.</div><div>The same webpage is used to trigger either external authentication either ldap one.</div><div>After LDAP/External authentication, we use an http call to a Rest API to get information about username and so populate saml response through attribute-resolver mechanism.</div><div><br></div><div>To achieve this, we didn't tweak completely the current file but added some custom flow that are very similar to the existing one:</div><div>We got a xxx-particulier-ldap-authn-config.xml and a xxx-particulier-password-authn-config.xml nearly identical to the ldap-authn-config.xml and password-authn-config.xml.</div><div>We have got a specific spring webflow for this auth flow. This is this flow which is using the </div><div><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(232,191,106)">/></span> which is mapped to the
ValidateUsernamePasswordAgainstLDAP in IDP3. <br></div><div>I'm not sure if it was really needed to redefine the whole flow or if we could have just tweaked the existing one.</div><div>Regards,</div><div>Claude</div><div>PS: here is the custom webflow:</div><div><br></div><div>particuliers-flow.xml</div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"JetBrains Mono",monospace"><span style="color:rgb(232,191,106)"><flow </span><span style="color:rgb(186,186,186)">xmlns</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/webflow" target="_blank">http://www.springframework.org/schema/webflow</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">xsi</span><span style="color:rgb(106,135,89)">="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">xsi</span><span style="color:rgb(186,186,186)">:schemaLocation</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/webflow" target="_blank">http://www.springframework.org/schema/webflow</a> <a href="http://www.springframework.org/schema/webflow/spring-webflow.xsd" target="_blank">http://www.springframework.org/schema/webflow/spring-webflow.xsd</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">parent</span><span style="color:rgb(106,135,89)">="authn.abstract, authn/conditions"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!--<br></span><span style="color:rgb(128,128,128)"> This is a login flow for basic-auth or form-based password authentication. The back-end step is named<br></span><span style="color:rgb(128,128,128)"> "ValidateUsernamePassword" and can be supplied by different back-end implementation files.<br></span><span style="color:rgb(128,128,128)"> --><br></span><span style="color:rgb(128,128,128)"><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><var </span><span style="color:rgb(186,186,186)">name</span><span style="color:rgb(106,135,89)">="thisFlow" </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.AuthenticationFlowDescriptor" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <action-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ExtractUsernamePasswordFromBasicAuth"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="ExtractUsernamePasswordFromBasicAuth" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="'proceed'" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <br></span><span style="color:rgb(232,191,106)"> <br></span><span style="color:rgb(232,191,106)"> <br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- Fall through to a different flow if basic-auth extract fails on a passive or non-browser request. --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ReselectFlow" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="NoCredentials" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="DisplayUsernamePasswordPage" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="InvalidCredentials" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="DisplayUsernamePasswordPage" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <on-exit><br></span><span style="color:rgb(232,191,106)"> <set </span><span style="color:rgb(186,186,186)">name</span><span style="color:rgb(106,135,89)">="thisFlow" </span><span style="color:rgb(186,186,186)">value</span><span style="color:rgb(106,135,89)">="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow()" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </on-exit><br></span><span style="color:rgb(232,191,106)"> </action-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <view-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="DisplayUsernamePasswordPage" </span><span style="color:rgb(186,186,186)">view</span><span style="color:rgb(106,135,89)">="xxxx/particulier"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <on-render><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="environment" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.environment" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="opensamlProfileRequestContext" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.profileRequestContext" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.authenticationContext" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="authenticationContext.getPotentialFlows().values().?[id matches 'authn/(' + (flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.Password.ExtendedFlows') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.Password.ExtendedFlows').trim() : '') + ')']" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.extendedAuthenticationFlows" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.Password.PrincipalOverride') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.Password.PrincipalOverride') : null" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.passwordPrincipals" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.rpUIContext" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationErrorContext))" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.authenticationErrorContext" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationWarningContext))" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.authenticationWarningContext" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.LDAPResponseContext))" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.ldapResponseContext" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.encoder" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="flowRequestContext.getExternalContext().getNativeRequest()" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.request" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="flowRequestContext.getExternalContext().getNativeResponse()" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.response" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" </span><span style="color:rgb(186,186,186)">result</span><span style="color:rgb(106,135,89)">="viewScope.custom" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </on-render><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ExtractUsernamePasswordFromFormRequest"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="authenticationContext.setAttemptedFlow(thisFlow)" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </transition><br></span><span style="color:rgb(232,191,106)"> <br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed_fas" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="FASAuthSelected"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed_gestionDeCompte" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="GestionDeCompteAuthSelected"</span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="#{currentEvent.id.startsWith('authn/')}" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="PreserveAuthenticationFlowState"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="authenticationContext.setAttemptedFlow(authenticationContext.getPotentialFlows().get(currentEvent.id))" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </transition><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <on-exit><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="opensamlProfileRequestContext.addSubcontext(new net.shibboleth.idp.consent.context.ConsentManagementContext(), true).setRevokeConsent(requestParameters._shib_idp_revokeConsent == 'true')" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </on-exit><br></span><span style="color:rgb(232,191,106)"> </view-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <action-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="PreserveAuthenticationFlowState"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="PreserveAuthenticationFlowState" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="'proceed'" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="CallExtendedFlow" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </action-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <subflow-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="CallExtendedFlow" </span><span style="color:rgb(186,186,186)">subflow</span><span style="color:rgb(106,135,89)">="#{opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow().getId()}"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <input </span><span style="color:rgb(186,186,186)">name</span><span style="color:rgb(106,135,89)">="calledAsSubflow" </span><span style="color:rgb(186,186,186)">value</span><span style="color:rgb(106,135,89)">="true" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <input </span><span style="color:rgb(186,186,186)">name</span><span style="color:rgb(106,135,89)">="calledAsExtendedFlow" </span><span style="color:rgb(186,186,186)">value</span><span style="color:rgb(106,135,89)">="true" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="DisplayUsernamePasswordPage"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getIntermediateFlows().put(opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow().getId(), opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow())" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </transition><br></span><span style="color:rgb(232,191,106)"> </subflow-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <action-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ExtractUsernamePasswordFromFormRequest"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="ExtractUsernamePasswordFromFormRequest" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="'proceed'" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- Let the validate action handle any problems later. --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><transition </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </action-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <action-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(186,186,186)">parent</span><span style="color:rgb(106,135,89)">="authn/conditions#ValidateUsernamePassword"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="'proceed'" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ContinueSuccessfulAuthentication" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- Fall through to a different flow if login fails on a passive or non-browser request. --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ReselectFlow" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- Other event transitions are determined by deployer in /flows/authn/conditions/conditions-flow.xml --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"></action-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <action-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ContinueSuccessfulAuthentication"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="PopulateSubjectCanonicalizationContext" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="'proceed'" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="CallSubjectCanonicalization" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </action-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- This runs a c14n step on the result of the authentication. --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><subflow-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="CallSubjectCanonicalization" </span><span style="color:rgb(186,186,186)">subflow</span><span style="color:rgb(106,135,89)">="c14n"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <input </span><span style="color:rgb(186,186,186)">name</span><span style="color:rgb(106,135,89)">="calledAsSubflow" </span><span style="color:rgb(186,186,186)">value</span><span style="color:rgb(106,135,89)">="true" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="SubjectCanonicalizationError" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ReselectFlow" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </subflow-state><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean-import </span><span style="color:rgb(186,186,186)">resource</span><span style="color:rgb(106,135,89)">="particulier-beans.xml" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"></flow><br></span></pre></div><div>and the particuliers-bean.xml:</div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"JetBrains Mono",monospace"><span style="color:rgb(232,191,106)"><?</span><span style="color:rgb(186,186,186)">xml version</span><span style="color:rgb(106,135,89)">="1.0" </span><span style="color:rgb(186,186,186)">encoding</span><span style="color:rgb(106,135,89)">="UTF-8"</span><span style="color:rgb(232,191,106)">?><br></span><span style="color:rgb(232,191,106)"><beans </span><span style="color:rgb(186,186,186)">xmlns</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/beans" target="_blank">http://www.springframework.org/schema/beans</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">context</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/context" target="_blank">http://www.springframework.org/schema/context</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">util</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/util" target="_blank">http://www.springframework.org/schema/util</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/p" target="_blank">http://www.springframework.org/schema/p</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">c</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/c" target="_blank">http://www.springframework.org/schema/c</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">xmlns:</span><span style="color:rgb(152,118,170)">xsi</span><span style="color:rgb(106,135,89)">="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">xsi</span><span style="color:rgb(186,186,186)">:schemaLocation</span><span style="color:rgb(106,135,89)">="<a href="http://www.springframework.org/schema/beans" target="_blank">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd" target="_blank">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br></span><span style="color:rgb(106,135,89)"> <a href="http://www.springframework.org/schema/context" target="_blank">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd" target="_blank">http://www.springframework.org/schema/context/spring-context.xsd</a><br></span><span style="color:rgb(106,135,89)"> <a href="http://www.springframework.org/schema/util" target="_blank">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd" target="_blank">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br></span><span style="color:rgb(106,135,89)"><br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">default-init-method</span><span style="color:rgb(106,135,89)">="initialize"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">default-destroy-method</span><span style="color:rgb(106,135,89)">="destroy"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:placeholderPrefix</span><span style="color:rgb(106,135,89)">="%{" </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:placeholderSuffix</span><span style="color:rgb(106,135,89)">="}" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="shibboleth.StorageBackedAccountLockoutManager" </span><span style="color:rgb(186,186,186)">abstract</span><span style="color:rgb(106,135,89)">="true"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.StorageBackedAccountLockoutManager"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:storageService-ref</span><span style="color:rgb(106,135,89)">="shibboleth.StorageService"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <property </span><span style="color:rgb(186,186,186)">name</span><span style="color:rgb(106,135,89)">="lockoutKeyStrategy"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.StorageBackedAccountLockoutManager.UsernameIPLockoutKeyStrategy"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:httpServletRequest-ref</span><span style="color:rgb(106,135,89)">="shibboleth.HttpServletRequest" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </property><br></span><span style="color:rgb(232,191,106)"> </bean><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <import </span><span style="color:rgb(186,186,186)">resource</span><span style="color:rgb(106,135,89)">="../../../conf/authn/xxxx/xxxx-particulier-password-authn-config.xml" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ExtractUsernamePasswordFromBasicAuth"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:httpServletRequest-ref</span><span style="color:rgb(106,135,89)">="shibboleth.HttpServletRequest"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:lowercase-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Lowercase"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:uppercase-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Uppercase"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:trim-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Trim"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:transforms-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Transforms" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="PreserveAuthenticationFlowState"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.PreserveAuthenticationFlowState" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:httpServletRequest-ref</span><span style="color:rgb(106,135,89)">="shibboleth.HttpServletRequest"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:parameterNames</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.ExtendedFlowParameters')}" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ExtractUsernamePasswordFromFormRequest"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromFormRequest" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:httpServletRequest-ref</span><span style="color:rgb(106,135,89)">="shibboleth.HttpServletRequest"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:usernameFieldName-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.UsernameFieldName"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:passwordFieldName-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.PasswordFieldName"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:SSOBypassFieldName-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.SSOBypassFieldName"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:lowercase-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Lowercase"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:uppercase-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Uppercase"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:trim-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Trim"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:transforms-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Transforms" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePasswordAgainstJAAS"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:savePasswordToCredentialSet</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:removeContextAfterValidation</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:loginConfigStrategy</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.JAAS.LoginConfigStrategy')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:loginConfigNames</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.JAAS.LoginConfigNames')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:loginConfigurations</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.JAAS.LoginConfigurations')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:loginConfigType</span><span style="color:rgb(106,135,89)">="JavaLoginConfig"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:addDefaultPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.addDefaultPrincipals') ?:<br></span><span style="color:rgb(106,135,89)"> (getObject('shibboleth.authn.Password.PrincipalOverride') == null<br></span><span style="color:rgb(106,135,89)"> or getObject('shibboleth.authn.Password.PrincipalOverride').isEmpty())}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:supportedPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:classifiedMessages-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.ClassifiedMessageMap"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:resultCachingPredicate</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.resultCachingPredicate')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:matchExpression</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.matchExpression')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:lockoutManager</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.AccountLockoutManager')}"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <property </span><span style="color:rgb(186,186,186)">name</span><span style="color:rgb(106,135,89)">="loginConfigParameters"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="java.security.URIParameter"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <constructor-arg </span><span style="color:rgb(186,186,186)">ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.JAAS.JAASConfigURI" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> </bean><br></span><span style="color:rgb(232,191,106)"> </property><br></span><span style="color:rgb(232,191,106)"> </bean><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePasswordAgainstKerberos"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstKerberos" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:savePasswordToCredentialSet</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:removeContextAfterValidation</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:refreshKrb5Config-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Krb5.RefreshConfig"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:preserveTicket-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Krb5.PreserveTicket"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:servicePrincipal</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Krb5.ServicePrincipal')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:keytabPath</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Krb5.Keytab')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:addDefaultPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.addDefaultPrincipals') ?:<br></span><span style="color:rgb(106,135,89)"> (getObject('shibboleth.authn.Password.PrincipalOverride') == null<br></span><span style="color:rgb(106,135,89)"> or getObject('shibboleth.authn.Password.PrincipalOverride').isEmpty())}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:supportedPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:classifiedMessages-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.ClassifiedMessageMap"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:resultCachingPredicate</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.resultCachingPredicate')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:matchExpression</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.matchExpression')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:lockoutManager</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.AccountLockoutManager')}" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- Parent beans for custom ldaptive CredentialConfig types. --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="shibboleth.X509ResourceCredentialConfig"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" </span><span style="color:rgb(186,186,186)">abstract</span><span style="color:rgb(106,135,89)">="true" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="shibboleth.KeystoreResourceCredentialConfig"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig" </span><span style="color:rgb(186,186,186)">abstract</span><span style="color:rgb(106,135,89)">="true" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePasswordAgainstLDAP"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:savePasswordToCredentialSet</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:removeContextAfterValidation</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:authenticator-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.authenticator"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:addDefaultPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.addDefaultPrincipals') ?:<br></span><span style="color:rgb(106,135,89)"> (getObject('shibboleth.authn.Password.PrincipalOverride') == null<br></span><span style="color:rgb(106,135,89)"> or getObject('shibboleth.authn.Password.PrincipalOverride').isEmpty())}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:supportedPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:classifiedMessages-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.ClassifiedMessageMap"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:resultCachingPredicate</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.resultCachingPredicate')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:matchExpression</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.matchExpression')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:returnAttributes-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.returnAttributes"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:lockoutManager</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.AccountLockoutManager')}" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="PopulateSubjectCanonicalizationContext"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:availableFlows-ref</span><span style="color:rgb(106,135,89)">="shibboleth.PostLoginSubjectCanonicalizationFlows" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"></beans><br></span></pre></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mer. 5 mai 2021 à 15:21, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 5/5/21, 9:11 AM, "users on behalf of Claude Libois" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:clibois.work@gmail.com" target="_blank">clibois.work@gmail.com</a>> wrote:<br>
<br>
> If I do understand you, it's never been a good practice to create its own authentication flow(with it's own<br>
> spring webflow) such as in our current idp configuration.<br>
<br>
You can, but you can't do it by copying ours without it breaking, which is why it broke.<br>
<br>
> I should only enable authentication flow in general-authn.xml by adding/removing flow in <util:list<br>
> id="shibboleth.AvailableAuthenticationFlows"> ?<br>
<br>
That's itself obsolete information in 4.1 but the Authentication topic discusses doing extensions of this sort and how to register them.<br>
<br>
> Am I right ? <br>
<br>
More or less but if you tell me what the actual goal of the custom flow was then it's easier to give a general pointer.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>
</blockquote></div>