<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This was great, Scott, thanks. I <b>think</b> this is working now, the code itself to do a results check first was quite straightforward, just terminating the flow does indeed reuse an existing result.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
However, I'll admit to the best part of a week spent wondering why my authn/SAML results kept disappearing irrespective of its lifetime setting in the bean (PT10M), and seemed to be entirely dependent on the defaultLifetime property (PT5M).</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The only way I could get them to persist was to set a lifetime for the MFA flow itself of at least as long as the SAML lifetime. This allowed the SAML flow to outlive the defaultLifetime and obey its bean override - setting the MFA lifetime to longer than the
SAML one shows the SAML flow result disappearing after its own specified lifetime.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=""><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">This is probably obvious, but is this because the MFAContext needs to be live in order to extract the results of the individual flows it calls?
(so if the MFA lifetime was less than the SAML one, the SAML result would disappear along with it?) I was maybe being a bit too careless with</span><font face="Calibri, Arial, Helvetica, sans-serif"><span style="font-size: 12pt;"> the MFA flow as I'd set it
to reuseCondition=false, and spent too long trying to work out if there was something wrong with beans/property settings!</span></font></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for the help again.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
John</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> 04 March 2022 16:55<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Session Lifetime of constituent flows in MFA</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 3/4/22, 11:44 AM, "users on behalf of John Watt" <users-bounces@shibboleth.net on behalf of John.Watt@glasgow.ac.uk> wrote:<br>
<br>
> For context, my MFA flow consists of a custom flow which renders a page that allows the user to select<br>
> either SAML or LDAP login flows via a button click. I'll have a look at reuseCondition but I assume this custom<br>
> flow selection page will need some way of remembering its previous result, or the selection page will be<br>
> rendered again for user interaction regardless of the subsequent lifetimes of any flows it invokes.<br>
<br>
You could probably impose a script that interrogates the MultiFactorAuthenticationContext's activeResults collection. That's where the child result(s) will be if they exist. That might just let you bypass the chooser and have it "run"whichever flow was active,
which will just cause it to reuse that result. In fact just terminating the MFA flow outright there is probably equivalent to that. If your script returns null, it will basically just package up whatever is there as the new set of results, effectively reusing
them all automatically.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>