Outbound interceptor flow for logout propagation messages

[Cantor, Scott]

On 8/6/21, 11:07 AM, "dev on behalf of Bachl, Mathias" <dev-bounces at shibboleth.net on behalf of mathias.bachl at brz.gv.at> wrote:

>    As far as I understood the code in saml2-logoutprop-flow.xml correctly, outbound interceptor flows defined
> for the SAML2.Logout profile are not applied to outgoing logout propagation messages. Can somebody
> confirm that?

It's not an inherently SAML-only concept, but for SAML logouts, I would be surprised if they don't run. But I don't have Eclipse in front of me to check and if you know enough to ask, I'm sure you're right.

>    Would it be desirable to include processing of the outbound interceptor flows in the saml2-logoutprop
>-flow.xml, or is there any reason it has been implemented without them?

I can't think of any reason offhand, there's a pretty standard set of machinery to run them that's pretty easy and transparent to add to flows. IIRC, we don't actually run any by default the way we do inbound, so it's pretty much a no-op hook when it's added.

Just file a bug/RFE (which is for the moment still the old server, we're about ready to start migrating the big projects over). If it's there and not working that's a bug anyway, so that's the simplest way to expedite the research/response.

It would be a 4.2 addition if it's missing, while if it's there and not working, it might show up in a patch.

-- Scott