Registering flow locations by pattern on Windows

[Cantor, Scott]

On 8/13/15, 9:41 AM, "dev on behalf of Misagh Moayyed" <dev-bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote:



>Well, it does seem like the Idp is normalizing paths only when idp.home is
>missing and then discovered automatically.

That's historical code I think. If you look at it, it's doing nothing, since the only "automatic" path is /opt/shibboleth-idp and normalizing that is a no-op.

That code has been through so many iterations through the 3 years of development and is so fragile that it's a big deal to just make any kind of global change to it that doesn't actually fix a limitation.

> My proposal would be to do the
>same regardless; that will fix the problem.

Maybe. It might also break lots of other edge cases we forget we had.

> It may be fair to put the onus
>on deployers and expect them to provide the normalized correct value,
>instructing them to read the docs to figure out why having seen that
>warning, etc.

It's not a question of fairness, but risk. Right now, we're essentially never relying on any normalization (as I say, the call that's there essentially is an identity transform), and what's great about that is it's predictably not doing anything weird.

If we did do something, I think that something cannot be "call some Spring utility that does who knows what", and I'm not sure what that would be that wouldn't end up causing other weirdness if people embedded backslahses to escape something.

I would be more inclined to do something in the installer(s) that gives the person the final say to go ahead, because then it's much less risky.

-- Scott