minimizing system directory changes

[Cantor, Scott]

On 1/13/16, 6:52 PM, "users on behalf of cneberg" <users-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:



>I've written my own per-SP authz plugin which runs using attribute consent as a model.  I've attempted to minimize changes to the system directories but these changes remain. Do you have ideas where I can move one or more of the changes - so they are not
> overwritten during an upgrade? 
>
>*defines the name intercept/authng-authz and location of authng-authz flow
>
>file: system/conf/webflow-config.xml
>
> <webflow:flow-location id="intercept/authng-authz" path="../conf/authng/authng-authz-flow.xml" />

User flows are loaded using a naming convention and do not need to be installed with a name. It's discussed in the documentation in various places, authentication for sure, but I thought a few other places. Put it in flows/intercept/authng-authz/authng-authz-flow.xml and it should load with the name intercept/authng-authz

>* Creates a new bean for authorization checking
>
>file: system/conf/profile-intercept-system.xml
>
>
>  <bean id="shibboleth.authng.AuthzFlow" abstract="true"
>          class="com.somesite.auth.actions.AuthzFlowDescriptor" />

You don't need an abstract parent bean at all, but it certainly doesn't need to be in there, any bean file in the root context will work. You shouldn't usually need your own descriptor type at all, really, but that depends on what you're doing I guess.

>*Creates a new endstate for authorization failures.
>
>file: system/flows/intercept/intercept-abstract-flow.xml
>
> <end-state id="AuthzRejected" />

That goes in conf/intercept/intercept-events-flow.xml

-- Scott