[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDes...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 14 12:59:30 2013
New Revision: 4854

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=4854&view=rev
Log:
Require non-zero AuthenticationResult timeout, and fix race condition.

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
    trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java?rev=4854&r1=4853&r2=4854&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java (original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java Mon Oct 14 12:59:30 2013
@@ -36,6 +36,7 @@
 import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 import net.shibboleth.utilities.java.support.component.IdentifiableComponent;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -52,6 +53,9 @@
 public class AuthenticationFlowDescriptor implements IdentifiableComponent, PrincipalSupportingComponent,
         StorageSerializer<AuthenticationResult> {
 
+    /** Additional allowance for storage of result records to avoid race conditions during use. */
+    public static final long STORAGE_EXPIRATION_OFFSET;
+    
     /** Default serializer for result objects. */
     private static final StorageSerializer<AuthenticationResult> DEFAULT_SERIALIZER;
     
@@ -68,7 +72,7 @@
     @Duration @NonNegative private long lifetime;
     
     /** Maximum amount of time in milliseconds, since last usage, a flow should be considered active. */
-    @Duration @NonNegative private long inactivityTimeout;
+    @Duration @Positive private long inactivityTimeout;
     
     /**
      * Supported principals, indexed by type, that the flow can produce.
@@ -88,6 +92,7 @@
     public AuthenticationFlowDescriptor(@Nonnull @NotEmpty final String id) {
         flowId = Constraint.isNotNull(StringSupport.trimOrNull(id), "Workflow ID cannot be null or empty");
         supportedPrincipals = new Subject();
+        inactivityTimeout = 30 * 60 * 1000;
     }
 
     /** {@inheritDoc} */
@@ -153,25 +158,24 @@
 
     /**
      * Gets the maximum amount of time in milliseconds, since the last usage, a flow should be considered active.
-     * A value of 0 indicates that there is no inactivity inactivityTimeout on an active flow.
-     * 
-     * @return the duration.
-     */
-    @NonNegative public long getInactivityTimeout() {
+     * 
+     * <p>Defaults to 30 minutes.</p>
+     * 
+     * @return the duration
+     */
+    @Positive public long getInactivityTimeout() {
         return inactivityTimeout;
     }
 
     /**
      * Sets the maximum amount of time in milliseconds, since the last usage, a flow should be considered active.
-     * A value of 0 indicates that there is no inactivity timeout on an active flow.
-     * 
-     * @param timeout the flow inactivity timeout, must be 0 or greater
-     */
-    public void setInactivityTimeout(@Duration @NonNegative final long timeout) {
-        inactivityTimeout = Constraint.isGreaterThanOrEqual(0, timeout,
-                "Inactivity timeout must be greater than or equal to 0");
-    }
-    
+     * 
+     * @param timeout the flow inactivity timeout, must be greater than zero
+     */
+    public void setInactivityTimeout(@Duration @Positive final long timeout) {
+        inactivityTimeout = Constraint.isGreaterThan(0, timeout, "Inactivity timeout must be greater than 0");
+    }
+
     /**
      * Check if a result generated by this flow is still active.
      * 
@@ -250,10 +254,10 @@
         // Back the expiration off by the inactivity timeout to recover the last activity time.
         if (resultSerializer != null) {
             return resultSerializer.deserialize(version, context, key, value,
-                    (expiration != null) ? expiration - inactivityTimeout : null);
+                    (expiration != null) ? expiration - inactivityTimeout - STORAGE_EXPIRATION_OFFSET : null);
         } else {
             return DEFAULT_SERIALIZER.deserialize(version, context, key, value,
-                    (expiration != null) ? expiration - inactivityTimeout : null);
+                    (expiration != null) ? expiration - inactivityTimeout - STORAGE_EXPIRATION_OFFSET : null);
         }
     }
 
@@ -288,5 +292,6 @@
 
     static {

[... 37 lines stripped ...]