[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAct...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Aug 15 23:31:45 2013
New Revision: 4696

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=4696&view=rev
Log:
Context for requested authn types, compat checking added to validation actions.

Added:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java   (with props)
Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/PrincipalEvalPredicateFactoryRegistry.java
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
    trunk/idp-authn-api/src/test/java/net/shibboleth/idp/authn/context/AuthenticationContextTest.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeAuthenticationContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstLDAP.java

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java?rev=4696&r1=4695&r2=4696&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java (original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java Thu Aug 15 23:31:45 2013
@@ -27,6 +27,7 @@
 
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.AuthenticationErrorContext;
+import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -37,6 +38,8 @@
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.EventContext;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Predicates;
 import com.google.common.collect.Collections2;
@@ -50,6 +53,9 @@
 public abstract class AbstractValidationAction extends AbstractAuthenticationAction
     implements PrincipalSupportingComponent {
 
+    /** Class logger. */
+    private final Logger log = LoggerFactory.getLogger(AbstractValidationAction.class);
+    
     /** Basis for {@link AuthenticationResult}. */
     @Nonnull private final Subject authenticatedSubject;
     
@@ -217,7 +223,44 @@
     @Nonnull protected Subject getSubject() {
         return authenticatedSubject;
     }
+
+    /** {@inheritDoc} */
+    protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+            @Nonnull final AuthenticationContext authenticationContext) throws AuthenticationException {
+        
+        // If the request mandates particular principals, evaluate this validating component to see if it
+        // can produce a matching principal. This skips validators chained together in flows that aren't
+        // able to satisfy the request.
+        final RequestedPrincipalContext rpCtx =
+                authenticationContext.getSubcontext(RequestedPrincipalContext.class, false);
+        if (rpCtx != null) {
+            log.debug("{} Request contains principal requirements, evaluating for compatibility", getLogPrefix());
+            for (Principal p : rpCtx.getRequestedPrincipals()) {
+                final PrincipalEvalPredicateFactory factory =
+                        authenticationContext.getPrincipalEvalPredicateFactoryRegistry().lookup(
+                                p.getClass(), rpCtx.getOperator());
+                if (factory != null) {
+                    if (factory.getPredicate(p).apply(this)) {
+                        log.debug("{} Compatible with principal type '{}' and operator '{}'", getLogPrefix(),
+                                p.getClass(), rpCtx.getOperator());
+                        return true;
+                    } else {
+                        log.debug("{} Not compatible with principal type '{}' and operator '{}'", getLogPrefix(),
+                                p.getClass(), rpCtx.getOperator());
+                    }
+                } else {
+                    log.debug("{} No comparison logic registered for principal type '{}' and operator '{}'",

[... 392 lines stripped ...]