Use workflow engine for authn

[jgomer2001]

In this issue I compile several whishes and ideas I have or have heard from others with respect to improving design and definition of authentication workflows

It has a broader scope than
GluuFederation/oxCore#124 so probably we can only start tackling this in 4.2 or 5.x

• Leverage a workflow engine/framework that can take charge of running the flows. A Small/manageable one (no big things like BPM)
• Flows potentially defined declaratively (ie xml, yaml...) or via GUI
• Better UX control in the navigation (eg. safe back button, retaking the point at which the flow was left)
• A good level of composability/modularization (eg. reuse of smaller flows to create more complex flows)
• Small decoupled chunks of code (no big scripts)

I did a small research in this regard. The only tool I found suitable is Spring Web Flow (actually it may suit very well). However the following is uncertain:

• how we can encompass oxauth (Weld) with it
• how to provide the flexibility we currently offer (jython scripting to add/edit flows on the fly) because it seems everything needs to be compiled/packaged beforehand. I checked grails framework which is built on top of Spring MVC and originally offered support for spring web flow but the plugin is not maintained anymore. Under Grails is Groovy, a language similar to python which can be used as scripting language in Java. So it might be a solution to evaluate.

Advanced wishlist:

• Some form of visualization of flow definitions (or graphical flow edition)
• AJAX in html pages, ie not necessarily change page when the flow step changes

Relevant use cases:

• Sophisticated identifier-first authentication
• Step-up authentication with parametric access policies
• A user registration process with credential enrollment

Related issues:

• Embrace a framework to facilitate definition/deployment of simple workflows casa#4
• add policy gui to make it easier to create policies for auth casa#10

[jgomer2001]

I conducted a small investigation on what would be required to implement a flow engine ourselves and concluded the effort is enormous. It's a really cumbersome project.

[nynymike]

Definitely agree. An enhancement like this should be the result of a formalized product decision. It makes sense to socialize this first.

[martynaslawinska]

The issue has been moved to Janssen: https://github.com/JanssenProject/jans-auth-server/issues/45