Where to define audit override beans?

[Cantor, Scott]

> <bean id="shibboleth.authn.Password.AuditExtractors" 
> parent="shibboleth.authn.Password.DefaultAuditExtractors" lazy-init="true">
> [...]

The quick answer is that the password audit log beans have to be in password-authn-config.xml

The SAML and CAS auditing beans are defined in the global root context, but the login flow beans are defined in the webflow context.

The longer answer/reason if you want to understand the actual architecture, which I should sketch out for answering this sort of thing:

The Spring context tree (which allows a bean in a child context to reference a bean in a parent) is laid out mostly outside our control, with a specific exception. There's a root context in the webapp, and then a context defined by the MVC servlet (mounted at /idp), and then every webflow gets its own under that when it runs for the first time.

Notably, some webflows are "children" of others, and so there are other parent/child contexts there, but "called subflows" are *not* children of any flow calling them, so e.g. the login flows are not children of the master authn flow nor of the SAML or CAS flows, just called by them. Most of the flows are therefore isolated, but are all children of the MVC context.

Lastly, the exception case is that we created reloadable Spring contexts inside of all our service subsystems, and those are isolated from everything else but are children of the global root. The attribute services, metadata service, access control service, etc. are all in that set.

-- Scott