[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/flows/authn/authn-beans.xml idp-conf/src/main/...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 14 16:07:14 2013
New Revision: 4857

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=4857&view=rev
Log:
Add action to handle identity switch, and fix up authn flow.

Added:
    trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/InvalidateSession.java   (with props)
    trunk/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/InvalidateSessionTest.java   (with props)
Modified:
    trunk/idp-conf/src/main/resources/flows/authn/authn-beans.xml
    trunk/idp-conf/src/main/resources/flows/authn/authn-flow.xml

Modified: trunk/idp-conf/src/main/resources/flows/authn/authn-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/flows/authn/authn-beans.xml?rev=4857&r1=4856&r2=4857&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/flows/authn/authn-beans.xml (original)
+++ trunk/idp-conf/src/main/resources/flows/authn/authn-beans.xml Mon Oct 14 16:07:14 2013
@@ -38,9 +38,13 @@
     
     <bean id="FinalizeAuthenticationFlow" class="net.shibboleth.idp.authn.impl.FinalizeAuthenticationFlow" scope="prototype" />
     
+    <bean id="InvalidateSession" class="net.shibboleth.idp.session.impl.InvalidateSession" scope="prototype"
+        p:sessionManager-ref="shibboleth.SessionManager" />
+    
     <bean id="FinalizeAuthentication" class="net.shibboleth.idp.authn.impl.FinalizeAuthentication" scope="prototype" />
     
     <bean id="UpdateSessionWithAuthenticationResult" class="net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult" scope="prototype"
-        p:enabled="${idp.session.enabled}" />
+        p:enabled="${idp.session.enabled}"
+        p:sessionManager-ref="shibboleth.SessionManager" />
     
 </beans>

Modified: trunk/idp-conf/src/main/resources/flows/authn/authn-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/flows/authn/authn-flow.xml?rev=4857&r1=4856&r2=4857&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/flows/authn/authn-flow.xml (original)
+++ trunk/idp-conf/src/main/resources/flows/authn/authn-flow.xml Mon Oct 14 16:07:14 2013
@@ -15,10 +15,10 @@
         <transition on="proceed" to="ExtractActiveAuthenticationResults" />
     </action-state>
     
-    <action state id="PopulateSessionContext">
+    <action-state id="PopulateSessionContext">
         <evaluate expression="PopulateSessionContext" />
         <transition on="proceed" to="ExtractActiveAuthenticationResults" />
-    </action>
+    </action-state>
     
     <action-state id="ExtractActiveAuthenticationResults">
         <evaluate expression="ExtractActiveAuthenticationResults" />
@@ -65,10 +65,20 @@
     <!-- This wraps up a fresh login by checking on the result of subject c14n. -->
     <action-state id="FinalizeAuthenticationFlow">
         <evaluate expression="FinalizeAuthenticationFlow" />
-        
+
         <transition on="proceed" to="FinalizeAuthentication" />
         
-        <!-- TODO: support appropriate behavior for IdentitySwitch here, maybe as a subflow -->
+        <!-- This can be routed to something more complex if desired. -->
+        <transition on="IdentitySwitch" to="InvalidateSession" />
+    </action-state>
+    
+    <!-- Handles an identity switch by dumping the old session. -->
+    <action-state id="InvalidateSession">
+        <evaluate expression="InvalidateSession" />
+        
+        <!-- Loop back up to finalize flow, guaranteed not to trigger a switch. -->
+        <transition on="proceed" to="FinalizeAuthenticationFlow" />
+        <transition on="InputOutputError" to="FinalizeAuthenticationFlow" />
     </action-state>
 
     <!-- Wraps up the subflow by producing a SubjectContext. -->