a note about removing the "consent" flow directory

[Tom Zeller]

As a follow up to last Friday's dev call where we talked about making
the consent flows abstract and moving them to system/ in order to make
upgrades easier, I think I'm going to remove the "consent" directory
from the consent flows, so that the flow IDs will be

post-authn/terms-of-use
post-authn/attribute-release

instead of

post-authn/consent/terms-of-use
post-authn/consent/attribute-consent

Because, if we use abstract parent flows in system/ to keep bean class
names out of user space, the <bean-import
location="../../../system/flows/post-authn/terms-of-use/terms-of-use-abstract-beans.xml"
/> path will have one less leading "../".

I wasn't sure what I was doing when I created the "consent" directory
anyway. The nice thing is, in conf/ all that is needed for a
terms-of-use or attribute-release flow is an empty flow definition
file that references the parent and a message source properties file.
That leaves plenty of room for merges in the flow def file including
additional bean-imports, and we shouldn't have to fuss much with
upgrades, unless I'm missing something.

Because we're modeling and persisting consent as id+string+boolean,
where in the terms-of-use case the id and string value are derived
from a message source, it seems like we could support a variety of
consent use cases fairly easily.

[Cantor, Scott]

Post by Tom Zeller
As a follow up to last Friday's dev call where we talked about making
the consent flows abstract and moving them to system/ in order to make
upgrades easier, I think I'm going to remove the "consent" directory
from the consent flows, so that the flow IDs will be
post-authn/terms-of-use
post-authn/attribute-release

I favor that, though we do we want to just rename that from post-authn to
intercept or interceptor?

-- Scott

[Tom Zeller]

Post by Cantor, Scott

Post by Tom Zeller
As a follow up to last Friday's dev call where we talked about making
the consent flows abstract and moving them to system/ in order to make
upgrades easier, I think I'm going to remove the "consent" directory
from the consent flows, so that the flow IDs will be
post-authn/terms-of-use
post-authn/attribute-release

I favor that, though we do we want to just rename that from post-authn to
intercept or interceptor?

Well, besides post-authn, is there another place in an SSO flow that
would be commonly called out to ? Personally, I like post-authn
because it makes it obvious when those flows are called. Maybe we
would never have pre-authn flows, but I guess my thought is that we
could have interceptor flows called at more than one point in an SSO
flow. It's not a strong opinion.

[Cantor, Scott]

Post by Tom Zeller
Well, besides post-authn, is there another place in an SSO flow that
would be commonly called out to ?

Mainly error handling, locked accounts and such, the ones I already
stubbed out some examples for.

Post by Tom Zeller
Personally, I like post-authn
because it makes it obvious when those flows are called. Maybe we
would never have pre-authn flows, but I guess my thought is that we
could have interceptor flows called at more than one point in an SSO
flow. It's not a strong opinion.

Agree there might be others, but I don't think the flows have to be named
that way necessarily, even if we use that name as the bean ID for the list
of flows to actually inject for use at that particular spot.

But I don't care that much, just didn't think it was that great a name
when I suggested it.

-- Scott

[Tom Zeller]

Post by Cantor, Scott

Post by Tom Zeller
Personally, I like post-authn
because it makes it obvious when those flows are called. Maybe we
would never have pre-authn flows, but I guess my thought is that we
could have interceptor flows called at more than one point in an SSO
flow. It's not a strong opinion.

Agree there might be others, but I don't think the flows have to be named
that way necessarily, even if we use that name as the bean ID for the list
of flows to actually inject for use at that particular spot.
But I don't care that much, just didn't think it was that great a name
when I suggested it.

Okay, I should rename "post-authn" to ... "intercept" ? And
"ProfileInterceptor*" to "ProfileIntercept*" ? Does that seem right ?

[Cantor, Scott]

Post by Tom Zeller
Okay, I should rename "post-authn" to ... "intercept" ? And
"ProfileInterceptor*" to "ProfileIntercept*" ? Does that seem right ?

interceptor sounds a little better to me.

-- Scott