password authn bean access in extensions

[Scott Cantor]

> On Aug 21, 2026, at 11:56 AM, Bobby Lawrence via users <users at shibboleth.net> wrote:
> 
> I'm trying to develop a custom admin flow defined in an extension jar which allows admins to add lockouts for users.
> 
> The problem is, my custom flow action cannot get the defined "shibboleth.authn.Password.AccountLockoutManager" bean unless I move that bean definition from conf/authn/password-authn-config.xml to either conf/global.xml or into my extensions post-config.xml.
> 
> Does anyone know why this would be?

Well, the "why" is just "that's how Spring contexts are organized". Every web flow is its own child context under the root WebAppContext that is populated by, among many other things, the contents of global.xml.

Children can see parent beans, but siblings can't see each others'

I thought I created an admin flow for altering or reading the lockout store:

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511437/AccountLockoutManagement

If you want to front-end it, I'd throw something simpler together that calls that endpoint. But if you're as web-dev hobbled as I am, maybe a webflow is "easier". Just wanted to make sure you know about it.

-- Scott