The main issue here is a cyclic dependency between the core 'portal' and
the 'agent' module of this component.
'agent' depends on the 'web/security' module of the core portal. It
relates to all portal authentication process once the sso system is done
processing the tokens with the underlying
sso infrastructure such as CAS, JOSSO, or Kerberos.
In a nutshell, I would think of it as an decoration of the core portal
authentication process, when users want sso functionality.
So options:
a/ move the 'agent' module into the core portal (not recommended since
its a plugin component. Not all users use the sso component)
b/ move some of the 'web security' stuff into a separate component
outside the core portal, may be even an existing component like WCI if
it makes sense. Then the sso agent can depend on this component just like
it does on others like 'container', 'services', 'ws', and
'rest'.
Thanks
Sohil