amserver

  • Filter
steve

committed 282 to openam

26 Jul
Fix for OPENAM-69, sometimes the uuid is upper case and other times lower
Peter Major

commented on CR-65

24 Jul

The patch looks good, but this is only the DAS part, or?

Peter Major

commented on CR-65

24 Jul

This should have been here in the first place, or DAS didn't supported this until now?

Peter Major

commented on CR-65

24 Jul

there's no need to check null'ness of persistCookieString, since the Boolean.valueOf can handle null values (they will be false).

steve

started review CR-65

24 Jul
OPENAM-168: Persistent Cookie setting function needs global settings and better security
steve

committed 278 to openam

22 Jul
Fix for OPENAM-47, additional code
steve

committed 272 to openam

22 Jul
Reverse Merge unwanted commits
deleted from defaultDelegationPoliciesForAmSDK.xml and modified AuthContext.java
steve

started review CR-63

22 Jul
OPENAM-162: Problem when unauthenticated user access "Logout endpoint"
steve

started review CR-62

22 Jul
OPENAM-163: Error when account lockout feature enabled
steve

started review CR-60

19 Jul
Fix for OPENAM-160
steve

committed 228 to openam

13 Jul
Fix for OPENAM-150
added to ClientSDKClasses
steve

committed 213 to openam

08 Jul
steve

The initial request will look like this:

"<?xml version="1.0" encoding="UTF-8"?><AuthContext version="1.0">
<Request authIdentifier="0"><NewAuthContext orgName="/"/></Request></AuthContext>"

So the requestType will be 0 and pretty much every thing else null. This holds for all authn types. We want the security handler to skip this first request only.

Peter Major

commented on CR-57

05 Jul

It looks like, you're not closing the InputStream, this could cause memory (/file handle) leak.

Peter Major

commented on CR-58

05 Jul

I think the idea here is that, when the requestType is 0, then the request is an AuthXMLRequest.NewAuthContext (constant with camelCase..). The problem is that when the agent tries to create the new AuthContext, then this if will prevent it from being check against appssotoken. Although the problem with this solution, that this will allow every authcontext-creation-request. So the key question is: how could we distinct the agent application 'registration', from a single agent-forwarded authentication?

steve

started review CR-58

05 Jul
OPENAM-100: With Remote Auth Security enabled, policy agents are denied access
steve

committed 208 to openam

05 Jul
steve

committed 207 to openam

05 Jul
steve

these are never going to be implemented as they are not used in this implementation

steve

agreed, will fix

steve

It's only one line of code and various different bits of the product call this is a variety of ways