[java-idp-testbed COMMIT] /trunk/src/main/config/system/flows/authn/jaas-authn-flow.xml

[noreply at shibboleth.net]

Author: scantor
Date: Tue Dec 10 13:27:40 2013
New Revision: 74

URL: http://svn.shibboleth.net/view/java-idp-testbed?rev=74&view=rev
Log:
- Fix passive behavior when login errors occur.
- Change how special conditions are handled.
- Add a callout for ExpiringPassword

Modified:
    trunk/src/main/config/system/flows/authn/jaas-authn-flow.xml

Modified: trunk/src/main/config/system/flows/authn/jaas-authn-flow.xml
URL: http://svn.shibboleth.net/view/java-idp-testbed/trunk/src/main/config/system/flows/authn/jaas-authn-flow.xml?rev=74&r1=73&r2=74&view=diff
==============================================================================
--- trunk/src/main/config/system/flows/authn/jaas-authn-flow.xml (original)
+++ trunk/src/main/config/system/flows/authn/jaas-authn-flow.xml Tue Dec 10 13:27:40 2013
@@ -43,11 +43,20 @@
         
         <transition on="proceed" to="CallSubjectCanonicalization" />
         
-        <transition on="#{ getConversationScope().get('org.opensaml.profile.context.ProfileRequestContext').getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext), false).getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationErrorContext), true).isClassifiedError('ExpiredPassword') }" to="CallExpiredPassword" />
-        <transition on="#{ getConversationScope().get('org.opensaml.profile.context.ProfileRequestContext').getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext), false).getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationErrorContext), true).isClassifiedError('AccountLocked') }" to="CallAccountLocked" />
+        <!-- Fall through to a different flow if login fails on a passive request. -->
+        <transition on="#{ flowRequestContext.getConversationScope().get('org.opensaml.profile.context.ProfileRequestContext').getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext), false).isPassive() }" to="ReselectFlow" />
+        
+        <!-- Call outs for exceptional conditions. -->
+        <transition on="ExpiringPassword" to="CallExpiringPassword" />
+        <transition on="ExpiredPassword" to="CallExpiredPassword" />
+        <transition on="AccountLocked" to="CallAccountLocked" />
         
         <transition on="#{true}" to="DisplayUsernamePasswordPage" />
     </action-state>
+
+    <subflow-state id="CallExpiringPassword" subflow="Authentication.ExpiringPassword">
+        <transition on="proceed" to="CallSubjectCanonicalization" />
+    </subflow-state>
 
     <subflow-state id="CallExpiredPassword" subflow="Authentication.ExpiredPassword">
         <transition on="proceed" to="DisplayUsernamePasswordPage" />