Ex: Re: finger pointing

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Tuesday, May 11, 2021 5:29 AM
> 
> You wouldn't have to, but even if you did, the warnings can always be
> internally aware of other details and detect things at runtime. It could just
> always return false for SAML and then true for the others.

Cool. For now I went ahead and just stuck an extra state in the CAS login flow, which turned out to be pretty easy:

    <decision-state id="ReturnToService">
        <if test="flowScope.serviceTicketRequest.method == 'POST'"
            then="PostBackToService"
            else="RedirectNotify" />
    </decision-state>

    <view-state id="RedirectNotify" view="authn-redirect">
        <attribute name="csrf_excluded" value="true" type="boolean"/>
        <transition on="proceed" to="RedirectToService" />
    </view-state>

Once I upgrade to 4.1 I will switch it to the warning intercept so I don't have to modify system configuration. Thanks much for the help...