Context Check Intercept

[Cantor, Scott]

> I wrote a script that will search the list of subjects from the subject
> context for the string I want to match on.  Seems that one of the subject
> values will always be org.ldaptive.jaas.LdapPrincipal followed by the DN.
> Will this always be available for the life of the session and does this
> seem OK?

I don't know your use case exactly, but the PRC->SubjectContext will always be the absolute authority on who the subject is for that request once the authn flow completes, and it should carry the canonicalized principal name (whatever you configure the IdP to "normalize" on) and a Java Subject that was produced by the AuthenticationResult used for that request.

What's in the Subject depends on your login methods and what they populate it with. In your case if that's LDAP it probably will have that custom Principal type. You absolutely should *not* just walk that list. You need to look at either the normalized name or specific Principal types you understand the meaning of for your use case.

The SubjectContext is independent of the session. These are all transitory per-request state objects, vs. the session that persists across requests. You don't need to worry about whether the SubjectContext content came from a previous session or not, it's upstream of where you're operating.

-- Scott