LogoutPropagationFlowDescriptor API Changes

[Cantor, Scott]

On 10/5/15, 4:23 PM, "dev on behalf of Cantor, Scott" <dev-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:



>On 10/5/15, 10:44 AM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:
>
>
>>
>>Since you seemed open to the change, I proceeded with the code changes locally and generated a diff for review:
>>
>>https://gist.github.com/serac/172f8d0b9babe418b4c7
>
>Thanks. So, a) adding the session type up into the descriptor's fine and b) the way I've done this  in other similar cases was to keep the activation condition field on the bean, but use a default condition that used the parent object's field to drive the condition (so basically still use the condition I had it using, but still solve your problem of being able to access the session type directly.

Specifically, this was in the SAML NameID consumer logic, with s/sessionType/format in that case. The Format value is plugged into the consumption beans and then a static condition class is configured in the Spring wiring that checks if the Format input matches the one on the bean:

<bean id="shibboleth.AbstractSAML2C14NFlowBean" abstract="true"
	class="net.shibboleth.idp.saml.nameid.NameIDCanonicalizationFlowDescriptor">
	<property name="activationCondition">
	<bean
	class="net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization.ActivationCondition" />
	</property>
    </bean>

The main reason I kept the activationCondition property in place was because it lets the deployer attach additional constraints on the bean alongside the "built-in" behavior.

-- Scott