[java-shib-idp2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/shibboleth/i...

[noreply at shibboleth.net]

Author: lajoie
Date: Mon Oct 10 16:49:17 2011
New Revision: 3073

URL: http://svn.shibboleth.net/view/java-shib-idp2?rev=3073&view=rev
Log:
Have each login handler report the authentication method it performed and document this need in the LoginHandler - SIDP-519

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/provider/IPAddressLoginHandler.java
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/provider/RemoteUserAuthServlet.java
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/provider/UsernamePasswordLoginServlet.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=3073&r1=3072&r2=3073&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Mon Oct 10 16:49:17 2011
@@ -3,6 +3,7 @@
 [SIDP-516] - Example login.jsp / Usage of label tag
 [SIDP-513] - idpui taglib could look for more languages matches
 [SIDP-514] - Alt text for IdP Logos is not esapiEncoder.encodeForHTMLAttribute
+[SIDP-519] - Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method
 [SIDP-520] - Ipad/iOS devices will auto capitalize text entered into the IdP login screen, which can cause errors. Adding an HTML element will prevent that
 [SIDP-522] - supplied examples shouldn't promote federation URIs as relying parties
 [SIDP-523] - Add access to inbound AuthnRequest

Modified: branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java?rev=3073&r1=3072&r2=3073&view=diff
==============================================================================
--- branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java (original)
+++ branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java Mon Oct 10 16:49:17 2011
@@ -47,11 +47,16 @@
  * {@link javax.security.auth.Subject} within the {@link edu.internet2.middleware.shibboleth.idp.session.Session}.</li>
  * </ul>
  * 
+ * The handler <strong>SHOULD</strong> also:
+ * <ul>
+ * <li>Bind a URI string, representing the authentication method actually used, to a request attribute identified by
+ * {@link #AUTHENTICATION_METHOD_KEY}. Failure to do so may lead to a situation where one authentication method is 
+ * started but a user switches to a weaker one in mid-process.  Without the login handler explicitly setting the 
+ * method, the first method that is started is what will be reported to the relying party.</li>
+ * </ul>
+ * 
  * The handler <strong>MAY</strong> also:
  * <ul>
- * <li>Bind a URI string, representing the authentication method actually used, to a request attribute identified by
- * {@link #AUTHENTICATION_METHOD_KEY}. This may be used if a handler is capable of performing multiple types of
- * authentication.</li>
  * <li>Bind an error message, if an error occurred during authentication to the request attribute identified by
  * {@link LoginHandler#AUTHENTICATION_ERROR_KEY}.</li>
  * <li>Bind a {@link AuthenticationException}, if an exception occurred during authentication to the request attribute

Modified: branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/provider/IPAddressLoginHandler.java
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/provider/IPAddressLoginHandler.java?rev=3073&r1=3072&r2=3073&view=diff
==============================================================================
--- branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/provider/IPAddressLoginHandler.java (original)
+++ branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/provider/IPAddressLoginHandler.java Mon Oct 10 16:49:17 2011
@@ -25,6 +25,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.opensaml.saml2.core.AuthnContext;
 import org.opensaml.xml.util.DatatypeHelper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -53,7 +54,15 @@
     /** Whether a user is "authenticated" if their IP address is within a configured IP range. */
     private boolean ipInRangeIsAuthenticated;
 
-    public IPAddressLoginHandler(String user, List<IPRange> ranges, boolean ipInRangeIsAuthenticated) {
+    /**
+     * Constructor.
+     * 
+     * @param user username to return upon successful "authentication"
+     * @param ranges range of IP addresses specified
+     * @param isIpInRangeAuthenticated whether the specified IP address range represent those that are authenticated or

[... 121 lines stripped ...]