Using requireSessionWith and Need Path Exclusion

[Cantor, Scott]

On 4/26/13 3:30 PM, "Jim Blankenship" <jblank at uw.edu> wrote:

>Any ideas how to disable auth checking when using requireSessionWith ?

That setting implies requiring a session. It's also generally very
superflous now so the solution is not to use it. If you need to customize
behavior, just add settings to the RequestMap directly, and then you can
set requireSession on or off as needed.

Assuming by "token" you mean you need a requested authn context class,
just add authnContextClassRef to the map.

If you touch a SessionInitiator at this point, you're probably doing more
work than needed.

Note that no matter what you do, that's not enough to force use of a
context class, you still need to check it on the way back in as an
authorization rule.

-- Scott