External authentication: MVC controller as alternative to servlet

[Misagh Moayyed]

> >Is this solution acceptable?
> >Or do we need to switch to an implementation based on a servlet?
> 
> I don't think I have any inherent objection (and yes, that's more what I
> wanted, explicit "top level" transparency in what was being plugged in,
> not so concerned about the internals of it once the requests are going
to
> that path).
> 
> I'd like to get input from people who've used Spring with MVC more to
make
> sure there's no concern with conflicts here, but I can't see any harm
from
> that kind of annotation.

If I can pitch in, generally that is not a problem. The IdP already has
the configuration to enable annotation-based controllers, etc built in and
that is more or less the approach I have taken with the OIDC work, partly
because it's simpler and partly because the libraries and frameworks that
are going to make OIDC possible heavily depend on annotations to wire up
beans. I am however making sure that no weird side effects arise as a
result of this auto registration process, and where possible, I intend to
move the configuration to an XML-based syntax.