OpenSAML Velocity templates for POST etc. responses

[Grady, Michael Allen]

On Jan 3, 2013, at 10:27 PM, Cantor, Scott wrote:

> 
> I would not be in favor of having anything that uses third party cookies
> or web tracking included in the code base. If somebody wants to do this,
> they can download any example files you want to post and do it easily
> enough. I think that's less confusing then renaming the files anyway.
> 

Understood. Do note that the Carnegie Mellon deployment isn't actually trying to "track the user", just record the trip thru the IdP and the SP to which the response is being sent (or the error that happened). And is setting the lifetime of the cookie that GA sets to 2 minutes. (GA provides an option to set that cookie lifetime, which otherwise defaults to 6 months.) So, yes, there is a GA cookie, but it doesn't need to stick around.  (Although I'll have to look closely when I explore using all of this in the next week or two to verify there isn't any other cookie this is causing to be set that does last longer.) Don't know if any of that would change your mind, just thought it was worth pointing out.

 https://developers.google.com/analytics/devguides/collection/gajs/methods/gaJSApiCampaignTracking#_gat.GA_Tracker_._setCampaignCookieTimeout


> I *am* willing to add a stubbed/empty #include to the templates in the jar
> file if it turns out that it's possible to include something from the
> classpath that lives in WEB-INF. Then they would just add the bits to that
> file so that instead of including nothing, it includes whatever they want
> it to include.

Thanks for considering that. I'll see what works, and get back to you.

> 
> That's slightly better in that it avoids duplicating the existing
> templates, but it's not a lot better.
> 

--
Michael A. Grady                      
University of Illinois at Urbana-Champaign (retired)
217-721-3890