{"action":"created","issue":{"url":"https://api.github.com/repos/codice/ddf-security/issues/21","labels_url":"https://api.github.com/repos/codice/ddf-security/issues/21/labels{/name}","comments_url":"https://api.github.com/repos/codice/ddf-security/issues/21/comments","events_url":"https://api.github.com/repos/codice/ddf-security/issues/21/events","html_url":"https://github.com/codice/ddf-security/pull/21","id":53812080,"number":21,"title":"2.5.x ddf 982","user":{"login":"jvettraino","id":4260932,"avatar_url":"https://avatars.githubusercontent.com/u/4260932?v=3","gravatar_id":"","url":"https://api.github.com/users/jvettraino","html_url":"https://github.com/jvettraino","followers_url":"https://api.github.com/users/jvettraino/followers","following_url":"https://api.github.com/users/jvettraino/following{/other_user}","gists_url":"https://api.github.com/users/jvettraino/gists{/gist_id}","starred_url":"https://api.github.com/users/jvettraino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvettraino/subscriptions","organizations_url":"https://api.github.com/users/jvettraino/orgs","repos_url":"https://api.github.com/users/jvettraino/repos","events_url":"https://api.github.com/users/jvettraino/events{/privacy}","received_events_url":"https://api.github.com/users/jvettraino/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-01-08T22:53:25Z","updated_at":"2015-01-09T16:54:45Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/codice/ddf-security/pulls/21","html_url":"https://github.com/codice/ddf-security/pull/21","diff_url":"https://github.com/codice/ddf-security/pull/21.diff","patch_url":"https://github.com/codice/ddf-security/pull/21.patch"},"body":"Added the ability to the PEP to continue to attempt to authorize anonymous users and let the PDP process those requests, and determine based on policy if the user should be granted access or not\n\n<!-- Reviewable:start -->\n[<img src=\"https://reviewable.io/review_button.png\" height=40 alt=\"Review on Reviewable\"/>](https://reviewable.io/reviews/codice/ddf-security/21)\n<!-- Reviewable:end -->\n"},"comment":{"url":"https://api.github.com/repos/codice/ddf-security/issues/comments/69362632","html_url":"https://github.com/codice/ddf-security/pull/21#issuecomment-69362632","issue_url":"https://api.github.com/repos/codice/ddf-security/issues/21","id":69362632,"user":{"login":"jvettraino","id":4260932,"avatar_url":"https://avatars.githubusercontent.com/u/4260932?v=3","gravatar_id":"","url":"https://api.github.com/users/jvettraino","html_url":"https://github.com/jvettraino","followers_url":"https://api.github.com/users/jvettraino/followers","following_url":"https://api.github.com/users/jvettraino/following{/other_user}","gists_url":"https://api.github.com/users/jvettraino/gists{/gist_id}","starred_url":"https://api.github.com/users/jvettraino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvettraino/subscriptions","organizations_url":"https://api.github.com/users/jvettraino/orgs","repos_url":"https://api.github.com/users/jvettraino/repos","events_url":"https://api.github.com/users/jvettraino/events{/privacy}","received_events_url":"https://api.github.com/users/jvettraino/received_events","type":"User","site_admin":false},"created_at":"2015-01-09T16:54:45Z","updated_at":"2015-01-09T16:54:45Z","body":"I can move it over to the anonymous interceptor especially for the patch branch as I think that makes sense with how the code is designed now.  \r\n\r\nHowever I suggest we looking to improve current design to cut down on complexity, code duplication, etc.  Its hard for someone who isn't intimately familiar with the security code to navigate, as there is a lot of the similar functionality in different places.  There are interceptors, filters, handlers, etc that do similar things (like perform the roll of the PEP, or do message validation), that are in different places b/c of the protocol (SOAP, REST, etc.).  I think the way anonymous requests are handled, should definitely be re-worked, as it is currently much more complex than it should be, and generating SAML doesn't make sense to me (and has HUGE performance implications).  That being said, putting the anon token generation in the PEP (with the code in the current state), is proliferating that confusing logic, so I definitely agree with you guys on moving the code over.\r\n\r\n@stustison hardcoded might have been the wrong word, perhaps limited is a better word.  Right now it is parsing the policy to create a Fake Assertion to send through Policy validation.  Getting the Fake token through Policy validation is contingent on parsing the policy in the same manner that the policy is being validated (and all of the pieces) - when in reality the goal is for the Fake token to always pass validation."}}