Routing Problems with SLO

[Cantor, Scott]

> I'm making some implicit assumptions about the testing environment that I
> assume to be true, but that makes sense in the abstract, and it's worth
> pointing out.

I don't know what testing environment you're talking about.

> Playing it back, you can't infer anything from the absence or the existence of
> conversational state in the abstract, and I'm presuming that the absence of
> conversational state in this canned environment means you can infer
> something.

I never said anything about conversational state. Flow conversations are tracked in, yes, the container session. That doesn't mean it all just dies if you don't have one. It creates one. That's how Java container sessions have always worked, they create themselves on demand and drop a cookie + rewrite the URL until the client sends back the cookie and establishes that the session is intact. If you blow that up mid-conversation, then SWF is going to throw an exception, which you can easily reproduce, but not at the very beginning. There's no conversation to worry about until the flow starts running.

Logout is just a flow, like any other. The only time the container session has to be intact is during a flow, not across flows. If I login at 1pm, let the container session lapse, and then logout at 2pm, I get a second container session to run the logout flow. The IdPSession is a whole other layer and is not stored in the container session, it's managed independently, because it has to be.

-- Scott