ProfileRequestContext accessibility outside flow actions

[Cantor, Scott]

On 8/13/15, 10:19 AM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:



>I have an arguably crazy use case for LDAP authn that I'll sketch out briefly. We want the ability to set the SASL authorization ID based on artifacts in the request like relying party ID and principal ID.

You shattered the crazy barrier by including SASL.

>It's pretty easy to imagine a lookup function of Function<HttpServletRequest, String> that would leverage the shibboleth.HttpServletRequest component to get at the request, and if the PRC were accessible as, say, a request attribute, it would be trivial to get at the needed subcontexts.

That would have to happen on every request though.

> I would like to propose that a simple one-liner be added to InitializeProfileRequestContext to support this case:

That would only work for a limited and relatively undefined subset of the flow. I wouldn't expect it to be there by the time LDAP authentication ran, for example, since by then it's gone back to the client.

-- Scott