"what metadata are you using"

[Brent Putman]

On 5/28/14 10:38 AM, Cantor, Scott wrote:
>
> The IdP has a status handler, but in V2 the access control on it is inside
> web.xml. I changed that in V3 by turning it into a webflow, 

I hadn't really looked at that yet.  Is there some reason a webflow is
necessary for things like this (admin/mgmt/monitoring endpoints)?  A
Spring MVC controller endpoint would probably work just as well, with
less machinery.  But a webflow works too, of course.


> but there's
> still a requirement to supply the ACL, and we just don't have any way to
> do that dynamically right now unless we build some kind of service layer
> to supply the access rules.

An idea:  maybe the rules could be held in an in-memory embedded
database like HSQLDB.  Any static rules which should be persistent and
loaded at IdP startup time could come from file on disk, easily
editable.  But it's also trivial to have dynamic non-persistent rules
using some tool (CLI, etc) which issues simple inserts/updates/deletes,
and doesn't require any restart.  The authZ enformement is then just a
simple query, which always gets up-to-date data.

In a cluster you'd have to do on each node, or else just know which node
you're hitting and update that one specifically.  Unless there's a way
to cluster HSQLDB or whatever, I don't know about that.

The reason I mentioned Spring MVC is that, as far as applying the rules
in a declarative fashion, you can do that with annotations.  I don't
think this would be that hard to implement.  Maybe there is also
something similar for SWF.  Worst case is that there's just a helper
method that is called programmatically inside each entry point where
authZ is to be enforced.