Integration with Capriza?

[Cantor, Scott]

> Some background.  "Capriza" is used to scrape legacy web applications and
> make them available in a mobile app with a clunky, but mobile, interface.
> The solution is made up of  a mobile app, WorkSimple; a cloud-based "API"
> server; and an on-prem server that hosts headless Firefox browsers
> (effectively, the Zapps).

I feel like I need a shower after reading this email.

> 1. In order to make this work, I have to turn off IdP session IP consistency.
> AFAICT, this is an IdP-wide setting.  In order to avoid this, I cranked up a new
> Shibboleth IdP, turned off IP consistency checking, and route traffic from the
> headless browser host to that IdP via the BigIP.  Is there some clever way
> that I'm overlooking to turn off IP address consistency checking by SP
> entityID or client IP address?

No, it's a session manager setting, and the session manager doesn't have access to the per-request state that would allow that setting to be turned into some kind of strategy function. It would take a significant change to get that decision pulled out into the "IdP proper" where that sort of dynamic behavior would be possible.

Also I think it might lead to weird results based on order of access. That's usually what happens when you start messing around with per-SP behavior connected to SSO outcomes. Haven't thought it through admittedly.

> 2. LocalStorage.  I assume there's no way to switch this based on SP entityID?

No, also global. It may be more amenable to becoming more dynamic because of how it works but again, not something I've thought about the implications of so I'm probably overlooking all kinds of issues with that.

There's a lot of Javascript ultimately involved in that determination. It's possible one could hack something up in that layer somehow maybe.

> And that leaves me wondering if anyone else has dealt with this application
> and found a better way.  Maybe I just haven't been asking Capriza the right
> questions or getting them to do the right things.

Well, turning off local storage outright presumably solves that one problem. That should force cookies regardless, at the cost of logout. I guess you could look at server side storage, maybe the hazelcast plugin Unicon has that a lot of people like.

I've never heard of this misbegotten Dunwich Horror of software, no.

-- Scott