As a System Administrator, I want to get rid of saml-hook

• Type: Story
• Status: Closed
• Priority: Minor
• Resolution: Completed
• Affects Version/s: None
• Fix Version/s: 7.4.2 CE GA3, 7.4.13 DXP GA1, Master
• Component/s: Application Security > SAML
• Labels:
  • 7.4-dxp
  • 7.4-must
  • fc_21_02
  • fc_21_03
  • fc_21_04
  • fc_21_05
  • fc_21_06
  • fc_21_07
  • has_acceptance_criteria
• Epic Link: SAML enhancements
• Sprint: AppSec Iteration 57, AppSec Iteration 58, AppSec Iteration 59, AppSec Iteration 60, AppSec Iteration 61, AppSec Iteration 62, AppSec Iteration 63, AppSec Iteration 64, AppSec Iteration 65, AppSec Iteration 66
• Git Pull Request: https://github.com/liferay-appsec/liferay-portal/pull/329

Motivation

SAML currently depends on a legacy hook plugin for certain functionality:

1. Adds custom JSPs to the portal that are then dispatched to from the JspUtil
2. Configures AutoLoginFilter for /c/portal/saml/auth_redirect

All this can be achieved with other features of portal and this should logically be contained within other existing SAML modules.

For example a new portlet with property "portlet.add.default.resource.check.whitelist" could be created for rendering SAML SLO status (the mentioned custom JSPs) with an absolute or relative URL in a metatype (See OAuth2's AuthorizeScreenConfiguration). This would bring the added benefit of customers being able to control which theme is applied to this screen.

Acceptance Criteria

1. As a System Administrator, I want to alternative solutions for all the functions that the saml-hook gives.
2. As a System Administrator, I want to get rid of the saml-hook and I don't want to deploy that anymore.