IdP v3.2.1 and Jetty 9.3.x canonicalization

[Cantor, Scott]

On 2/18/16, 7:02 PM, "users on behalf of King, David" <users-bounces at shibboleth.net on behalf of dsmk at bu.edu> wrote:



>My main question is whether I should edit the main password flow or create a new password flow and update the IdP properties.  What is considered the better practice in the long run?

You should never, ever, ever, ever touch a file in system/ and the only exception is to apply a patch that you need that would be coming in a later version and just sync back up when the next update is done.

That's basically the answer to your question.

>2) Creating an /opt/shibboleth-idp/flows/authn/BUPassword directory with both the beans and flows files.

The directory and naming conventions for custom flows are mentioned in a few places in the docs. You can't name the files anything but what they have to be named to match the flow ID, and that is more or less the directory to use, yes.

>3) Change the name of the authn/Password bean in the authn/general-authn.xml file to reference the new flow (authn/BUPassword bean).
>
>Is there anything else I need to do?  I can update the wiki once I am done with this if others are interested.

That's pretty much it, apart from making sure your copied flow is pulling in the configuration beans you want it to be. If you just copy the existing one, it's going to look for auth/password-authn-config.xml, etc. That may be what you want, or may not be.

But there's another point here, and it isn't good, but it is reality: the beans you're using that you get from copying the password flow's beans are *not* API. Those are implementation detals of our code, not public interfaces. If we want to change them to add features we will, and that can break your flow on an upgrade.

We can't provide APIs at this stage to allow total reuse of our entire codebase and still maintain the software.

You can take the risk, or copy the classes yourself to your own packages, but there's no secret trap, we're very clear in the versioning policy on what's public and not.

The flow file itself is yours, of course, you're not depending on ours if you copy it. But even if you copy the beans file, you're still referencing *.impl.* classes.

>-- relevant section of the password flow --
>
>    <action-state id="ExtractUsernamePasswordFromFormRequest">
>        <evaluate expression="ExtractUsernamePasswordFromFormRequest" />
>        <evaluate expression="'proceed'" />
>
>        <!-- Let the validate action handle any problems later. -->
>        <transition to="BULookupUsername" />
>    </action-state>

That's ok, but you have to bear in mind that ECP use won't do that, it would extract the name directly from the basic-auth header and directly validate it, bypassing your code. That may be fine, or may not be.

-- Scott