<div dir="ltr"><div>Hello Team, <br></div><div><br></div><div>I am trying to use the <a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631607/ExternalAuthnConfiguration">External Authentication flow</a> and upon receiving the initial request to my custom servlet, it goes through multiple redirects in our internal system and eventually redirects to the same servlet. However at this point, it is unable to find a flow by using the conversation key.</div><div>This works fine if, <u>finishExternalAuthentication</u> is called initially without any redirects.</div><div><br></div><div>Is the flow context resolution solely based on the conversation key or are there any other things that need to be maintained or propagated? I had a look at the data structure by debugging and clearly see the conversation list is empty.</div><div><br></div><div>Here is my sample code.</div><div><br></div><div><div style="background-color:rgb(255,255,255);color:rgb(8,8,8)"><pre style="font-family:"JetBrains Mono",monospace;font-size:9pt"><span style="color:rgb(158,136,13)">@Override<br></span><span style="color:rgb(0,51,179)">protected void </span><span style="color:rgb(0,98,122)">doGet</span>(<span style="color:rgb(0,0,0)">HttpServletRequest request</span>, <span style="color:rgb(0,0,0)">HttpServletResponse response</span>) <span style="color:rgb(0,51,179)">throws </span><span style="color:rgb(0,0,0)">IOException </span>{<br><br>    <span style="color:rgb(0,0,0)">String conversationKey </span>= <span style="color:rgb(0,0,0)">request</span>.getParameter(<span style="color:rgb(6,125,23)">"conversation-key"</span>);<br>    <span style="color:rgb(135,16,148)">log</span>.info(<span style="color:rgb(6,125,23)">"Received request at SAML handler: </span><span style="color:rgb(0,55,166)">{}</span><span style="color:rgb(6,125,23)">, conversationKey: </span><span style="color:rgb(0,55,166)">{}</span><span style="color:rgb(6,125,23)">"</span>, <span style="color:rgb(0,0,0)">request</span>.getRequestURL().toString(),<span style="color:rgb(0,0,0)">conversationKey</span>);<br><br>    <span style="color:rgb(0,51,179)">if </span>(<span style="color:rgb(0,0,0)">conversationKey </span>== <span style="color:rgb(0,51,179)">null</span>) {<br><br>       <span style="color:rgb(0,51,179)">try </span>{<br>          <span style="color:rgb(0,0,0)">conversationKey </span>= <span style="color:rgb(0,0,0)">ExternalAuthentication</span>.<span style="font-style:italic">startExternalAuthentication</span>(<span style="color:rgb(0,0,0)">request</span>);<br>       } <span style="color:rgb(0,51,179)">catch </span>(<span style="color:rgb(0,0,0)">ExternalAuthenticationException e</span>) {<br>          <span style="color:rgb(135,16,148)">log</span>.info(<span style="color:rgb(6,125,23)">"ExternalAuthenticationException occurred while starting external authentication"</span>, <span style="color:rgb(0,0,0)">e</span>);<br>          <span style="color:rgb(0,51,179)">throw new </span>RuntimeException(<span style="color:rgb(0,0,0)">e</span>);<br>       }<br><br>       <span style="color:rgb(140,140,140);font-style:italic">// Store any needed SAML parameters<br></span><span style="color:rgb(140,140,140);font-style:italic">       </span><span style="color:rgb(0,0,0)">request</span>.getSession().setAttribute(<span style="color:rgb(6,125,23)">"conversation-key"</span>, <span style="color:rgb(0,0,0)">conversationKey</span>);<br><br>       <span style="color:rgb(140,140,140);font-style:italic">// Redirect to your external authentication system<br></span><span style="color:rgb(140,140,140);font-style:italic">       </span><span style="color:rgb(0,0,0)">String redirectUri </span>= <span style="color:rgb(135,16,148)">ssoIdpConnectorServiceUrl </span>+ <span style="color:rgb(6,125,23)">"/connect/auth?</span><span style="color:rgb(6,125,23)">conversation-key</span><span style="color:rgb(6,125,23)">=" </span>+ <span style="color:rgb(0,0,0)">conversationKey</span>;<br>       <span style="color:rgb(0,0,0)">redirectUri </span>+= <span style="color:rgb(6,125,23)">"&redirect_uri=" </span>+ <span style="color:rgb(0,0,0)">URLEncoder</span>.<span style="font-style:italic">encode</span>(<span style="color:rgb(135,16,148)">callBackHost </span>+ <span style="color:rgb(6,125,23)">"/idp/auth/saml-handle?conversation-key=" </span>+ <span style="color:rgb(0,0,0)">conversationKey</span>,<br>             <span style="color:rgb(0,0,0)">StandardCharsets</span>.<span style="color:rgb(135,16,148);font-style:italic">UTF_8</span>);<br><br>       <span style="color:rgb(135,16,148)">log</span>.info(<span style="color:rgb(6,125,23)">"Redirecting to </span><span style="color:rgb(0,55,166)">{}</span><span style="color:rgb(6,125,23)">"</span>, <span style="color:rgb(0,0,0)">redirectUri</span>);<span style="color:rgb(140,140,140);font-style:italic"><br></span><span style="color:rgb(140,140,140);font-style:italic">       </span><span style="color:rgb(0,0,0)">response</span>.sendRedirect(<span style="color:rgb(0,0,0)">redirectUri</span>);<br><br>    } <span style="color:rgb(0,51,179)">else </span>{<br>       <span style="color:rgb(140,140,140);font-style:italic">// Create the Subject object (representing the authenticated user)<br></span><span style="color:rgb(140,140,140);font-style:italic">       </span><span style="color:rgb(0,0,0)">Subject subject </span>= <span style="color:rgb(0,51,179)">new </span>Subject();<br>       <span style="color:rgb(0,0,0)">subject</span>.getPrincipals().add(<span style="color:rgb(0,51,179)">new </span>UsernamePrincipal(<span style="color:rgb(6,125,23)">"user123"</span>));<br><br>       <span style="color:rgb(140,140,140);font-style:italic">// Attach the Subject to the request<br></span><span style="color:rgb(140,140,140);font-style:italic">       </span><span style="color:rgb(0,0,0)">request</span>.setAttribute(<span style="color:rgb(0,0,0)">ExternalAuthentication</span>.<span style="color:rgb(135,16,148);font-style:italic">SUBJECT_KEY</span>, <span style="color:rgb(0,0,0)">subject</span>);<br><br>       <span style="color:rgb(0,51,179)">try </span>{<br>          <span style="color:rgb(0,0,0)">ExternalAuthentication</span>.<span style="font-style:italic">finishExternalAuthentication</span>(<span style="color:rgb(0,0,0)">conversationKey</span>, <span style="color:rgb(0,0,0)">request</span>, <span style="color:rgb(0,0,0)">response</span>);<br>          <span style="color:rgb(135,16,148)">log</span>.info(<span style="color:rgb(6,125,23)">"Completed external authentication"</span>);<br>       } <span style="color:rgb(0,51,179)">catch </span>(<span style="color:rgb(0,0,0)">ExternalAuthenticationException e</span>) {<br>          <span style="color:rgb(0,51,179)">throw new </span>RuntimeException(<span style="color:rgb(0,0,0)">e</span>);<br>       }<br>    }<br>}</pre></div><img src="cid:ii_m930bn170" alt="Screenshot 2025-04-04 at 12.06.44 PM 2.jpg" width="558" height="159"></div><div><br></div><div>Appreciate any thoughts on this.</div><div>Thank you</div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><span style="font-family:trebuchet ms,sans-serif">Best Regards,<br>Aravinda Madushanka.</span><br><br></div></div></div></div></div></div></div></div></div></div></div>