minimizing system directory changes

[Cantor, Scott]

On 1/27/16, 11:58 AM, "users on behalf of cneberg" <users-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:



>The second half of my customization would be made easier by issue
>https://issues.shibboleth.net/jira/browse/IDP-784 If possible, can you let me know if/when this is scheduled?

It dropped off my radar, I scheduled it so it at least is considered. There is no schedule for 3.3 right now, and I doubt it would be very soon.

Using an outbound intercept is probably the best way right now since that runs during the final encoding of the message and if that fails it's clearly not issuing anything.

>I've noticed CAS.ValidateConfiguration doesn't support
>a postAuthenticationFlows flows attribute so I need to modify (or inherit the)
>CAS.ValidateConfiguration class to give it an entry point to call my custom code.   

I thought that flow was back channel ticket checking. Having a post-login intercept doesn't work for a non-authentication profile because those intercepts are expected to permit views.

All profiles should run the inbound and outbound intercepts though, and I think Marvin is cleaning that up for the CAS flows. It's just a useful extension point.

>If you are scheduling adding the custom gateting step at a high enough level it might cover all protocols. It's a security configuration issue that I have to remember to enable the enforcement class with each new protocol I enable.  It would be better if I could just enable it once at a high enough level it covered all protocols.

Everything is per-profile in the IdP, there is nothing at the level you mean. Meaning no matter what, it would have to get turned on per-profile unless it were just baked in as a default. It's possible something like that could be done via an injected Predicate that just defaults to "true" and would be overridable though, just to make it easier. But this is not a common feature, and adding more chrome that 99% of deployers have to overlook isn't a direction I like.

-- Scott