minimizing system directory changes

[Cantor, Scott]

> Can you suggest a simpler design?

I don't know what your class is doing. Unless you really need to add something, the InterceptFlowDescriptor class you inherited from would be directly usable to describe the flow to the system. If you flow has settings that need to be configurable though, that would be a reason to perhaps create a dedicated subclass, but that isn't the only way to deal with settings, they could be just configured and set directly into the the flow action beans that need them. That's how most of the authentication settings are handled.

>I'm a Spring newbie.  Also, as a new
> wrinkle I'm testing CAS auth, and I'm not having luck just simply putting  <ref
> bean="CAS.ValidateConfiguration"  p:postAuthenticationFlows="authng-
> authz" (error messages are below). 

A ref is pointing to an existing bean. If you want to set properties, you need to create your own bean that can inherit from the parent you're referencing.

> I'm looking for a simple and general
> design as possible.   My primary use case for authz is ensuring dynamic level
> of assurance (authentication level) requirements are enforced the same on
> the front end authentication as the backend without having to modify the
> SP's themselves.   Is that something you'd generally support if I filed an
> enhancement request?

We use AuthenticationContext in SAML to handle that, and the IdP already enforces that.

> The error I'm seeing when I enable the postAuthenticationFlow.

No, that's the error you see when the RP config is invalid. The error causing that already happened and was logged much earlier, probably at startup time and probably says something about a ref to a bean not being allowed to have properties or something.

-- Scott