How to use shibboleth.context-check.Function

[Cantor, Scott]

On 1/13/20, 8:23 PM, "users on behalf of Morgan, Andrew Jason" <users-bounces at shibboleth.net on behalf of morgan at oregonstate.edu> wrote:

> Is that correct?

Yes, more or less.

> Is it possible to define the ConditionMap in a way that won't require me to restart Shibboleth when I make a change?

I built a possible way to do it for V4 but it's fragile and not very easy to use, and doesn't always get the intended result. I find myself conflicted in that while I personally have leveraged the reloadability paradigm, and probably will continue to, the world is enamored of Docker and the idea that any change of any size means completely replacing the running system. So it's hard to justify continuing to invest in more and more reloadability tricks.

Generally it's probably better to try and push that kind of thing into the resolver and try and get a consistent answer out that you can code a single condition against.

The purpose of the function mechanism is more to support alternative error events coming back since the old condition model had to produce just a single ContextCheckDenied outcome.
 
-- Scott