minimizing system directory changes

[cneberg]

Thank you that worked well.

>You don't need an abstract parent bean at all, but it certainly doesn't
need to be in there, any bean file in the root context will work. You
shouldn't usually need your own descriptor type at all, really, but that
depends on what you're doing I guess.

Can you suggest a simpler design?   I'm a Spring newbie.  Also, as a new
wrinkle I'm testing CAS auth, and I'm not having luck just simply putting
<ref bean="CAS.ValidateConfiguration"
p:postAuthenticationFlows="authng-authz" (error messages are below).    I'm
looking for a simple and general design as possible.   My primary use case
for authz is ensuring dynamic level of assurance (authentication level)
requirements are enforced the same on the front end authentication as the
backend without having to modify the SP's themselves.   Is that something
you'd generally support if I filed an enhancement request?

The error I'm seeing when I enable the postAuthenticationFlow.

2016-01-25 09:46:21,683 - DEBUG
[net.shibboleth.idp.cas.service.PatternServiceRegistry:85] - 111.111.11.1 -
Evaluating whether https://test.mysite.com/cgi-bin/test matches http://
([A-Za-z0-9_-]+\.)*mysite\.com(:\d+)?/.*
2016-01-25 09:46:21,684 - DEBUG
[net.shibboleth.idp.cas.flow.impl.BuildRelyingPartyContextAction:84] -
111.111.11.1 - Setting up RP context for unverified relying party
https://test.mysite.com/cgi-bin/test
2016-01-25 09:46:21,696 - ERROR
[net.shibboleth.idp.relyingparty.impl.ReloadingRelyingPartyConfigurationResolver:107]
- 111.111.11.1 - RelyingPartyResolver
'shibboleth.RelyingPartyConfigurationResolver': error looking up Relying
Party: Invalid configuration.
2016-01-25 09:46:21,697 - DEBUG
[net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:131] -
111.111.11.1 - Profile Action SelectRelyingPartyConfiguration: No relying
party configuration applies to this request
2016-01-25 09:46:21,706 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - 111.111.11.1 - An error
event occurred while processing the request:
InvalidRelyingPartyConfiguration

-Christopher

On Wed, Jan 13, 2016 at 6:13 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/13/16, 6:52 PM, "users on behalf of cneberg" <
> users-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:
>
>
>
> >I've written my own per-SP authz plugin which runs using attribute
> consent as a model.  I've attempted to minimize changes to the system
> directories but these changes remain. Do you have ideas where I can move
> one or more of the changes - so they are not
> > overwritten during an upgrade?
> >
> >*defines the name intercept/authng-authz and location of authng-authz flow
> >
> >file: system/conf/webflow-config.xml
> >
> > <webflow:flow-location id="intercept/authng-authz"
> path="../conf/authng/authng-authz-flow.xml" />
>
> User flows are loaded using a naming convention and do not need to be
> installed with a name. It's discussed in the documentation in various
> places, authentication for sure, but I thought a few other places. Put it
> in flows/intercept/authng-authz/authng-authz-flow.xml and it should load
> with the name intercept/authng-authz
>
> >* Creates a new bean for authorization checking
> >
> >file: system/conf/profile-intercept-system.xml
> >
> >
> >  <bean id="shibboleth.authng.AuthzFlow" abstract="true"
> >          class="com.somesite.auth.actions.AuthzFlowDescriptor" />
>
> You don't need an abstract parent bean at all, but it certainly doesn't
> need to be in there, any bean file in the root context will work. You
> shouldn't usually need your own descriptor type at all, really, but that
> depends on what you're doing I guess.
>
> >*Creates a new endstate for authorization failures.
> >
> >file: system/flows/intercept/intercept-abstract-flow.xml
> >
> > <end-state id="AuthzRejected" />
>
> That goes in conf/intercept/intercept-events-flow.xml
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160125/cfa8871d/attachment.html>