Handling a parameter to logout flow

[Christopher Bongaarts]

Finally getting knee-deep into v3, and implementing our various v2 hacks 
using built-in functionality that 3 provides where possible.

One of our current functions that (almost) already exists in 3 is a 
proprietary IdP logout endpoint.  We've been able to configure an 
internal redirect in Jetty so that our v2 endpoint path is handled by 
the /idp/profile/Logout flow (though if there's a better way to do that, 
we'd love to hear how).  Now we're trying to add support for a "return" 
URL parameter, which can be used to indicate where to redirect the user 
after logout has completed (instead of showing our generic "you've 
logged out" page).  This is intended to work similarly to the SP's 
"return" parameter on its local logout endpoint.

We've found at least one avenue for making this work.  We added the 
following to system/flows/logout/logout-flow.xml:

     <on-start>
         <evaluate expression="requestParameters.return" 
result="flowScope.returnurl"/>
     </on-start>

which makes the parameter available to the flow and its views. From 
here, we could handle the redirect a number of ways, perhaps by doing an 
externalRedirect in the flow, or using Javascript in the view.

My questions would be:

- Is this a reasonable approach?
- Is there a 'best practice' for handling the redirect among (or beyond) 
the approaches I've considered?
- Editing system/* makes me feel icky.  Is there a preferred way to 
modify or insert things into the flow without having to do this?  Should 
I be copying the logout-flows.xml into flows/ somewhere to override the 
system flow definition?  Are intercepts available in the logout flow 
(most of the docs seem to focus on authn flows)?

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%