SWF action beans and class variables safety

[Cantor, Scott]

On 3/29/19, 6:39 AM, "dev on behalf of Etienne Dysli Metref" <dev-bounces at shibboleth.net on behalf of etienne.dysli-metref at switch.ch> wrote:

> Is it [thread-]safe to store request-dependent state in class variables,
> where the class extends net.shibboleth.idp.profile.AbstractProfileAction
> and the state is used in both doPreExecute() and doExecute()?

The action class is meant to be used by creating a new instance for every request, so it's safe when used that way. All action beans in the IdP are prototypes for that reason.

> I don't remember the exact guarantees provided by SWF or the contract for IdP extensions

There isn't one because if you screw up the scope and leave it out, the bean will be a singleton and the IdP can't detect that. I thought about adding a bean post processor to detect that at one point.

> Can one action bean instance be used by multiple threads (provided it has scope=prototype)?

No, due to how they get created. Actions are referenced by Spring when the transition to the state occurs in the flow conversation, and if it's a prototype, getBean causes a new object to be returned.

-- Scott