only displaying one warning intercept out of several with warning module in idp v4.1

[Cantor, Scott]

On 2/9/22, 2:29 PM, "users on behalf of Jeffrey Eaton" <users-bounces at shibboleth.net on behalf of jeaton at cmu.edu> wrote:

>    I'm currently doing this with multiple entries in the shibboleth.warning.ConditionMap pointing to a scripted
> condition which when it decides to show the condition, it also shoves a flag into the AuthenticationContext
> stateMap.  If the later conditions see that flag, they bypass their check.  Is this the best way?

Use your own (org.opensaml.messaging.context.ScratchContext) and stick it in the tree so you can keep it separated. We don't use that class because we control the API so we can always define what we need; it's there for deployers to use. For that matter you can also define your own if you're working in Java.

>  Is the ordering of the conditions in the ConditionMap fixed, or can it vary?

That's a valid issue because the code iterates it (in fact it broke on Java 17 for a related reason). It turns out Spring uses LinkedHashMap by default, which is ordered so it does work consistently, but that's not the actual Map guarantee, so I should have specified the use of LinkedHashMap explicitly when declaring the map in the file to ensure that. It's a bug, please file it. It should ensure that you can rely on the order. 

>    As an aside, is there a way to reduce the code duplication in my conditions?

Using Java should allow a certain amount of it, yes. There's no way I know of to reuse Javascript non-locally in the manner Java supports it for scripting.

-- Scott