"what metadata are you using"

[Cantor, Scott]

On 5/28/14, 2:11 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>I hadn't really looked at that yet.  Is there some reason a webflow is
>necessary for things like this (admin/mgmt/monitoring endpoints)?  A
>Spring MVC controller endpoint would probably work just as well, with
>less machinery.  But a webflow works too, of course.

Mostly I did it just to get additional experience, and because I was on a
long flight and needed something to work on. I don't care that much how it
ends up. I didn't want it to be a servlet because of the need to touch
web.xml, and I don't really know anything about Spring MVC.

>An idea:  maybe the rules could be held in an in-memory embedded
>database like HSQLDB.  Any static rules which should be persistent and
>loaded at IdP startup time could come from file on disk, easily
>editable.  But it's also trivial to have dynamic non-persistent rules
>using some tool (CLI, etc) which issues simple inserts/updates/deletes,
>and doesn't require any restart.  The authZ enformement is then just a
>simple query, which always gets up-to-date data.

That works, but I'm not sure if it's worth the effort compared to building
a simple service facade, which we already have lots of examples of. The
main advantage would probably be the efficiency of updates taking effect.

>The reason I mentioned Spring MVC is that, as far as applying the rules
>in a declarative fashion, you can do that with annotations.  I don't
>think this would be that hard to implement.  Maybe there is also
>something similar for SWF.  Worst case is that there's just a helper
>method that is called programmatically inside each entry point where
>authZ is to be enforced.

FWIW, I wrote a SWF action (actually it's an OpenSAML one, but it doesn't
really have any relevance there) to enforce client address access control
in a flow. So I did factor it out, it's just that the configuration of
that action is in a flow bean file, thus not reloadable right now.
Obviously that can be changed.

-- Scott