[java-idp-testbed COMMIT] in /trunk/src/main/resources/flows/authn: authn-beans.xml authn-flow.xml

[noreply at shibboleth.net]

Author: scantor
Date: Tue Oct 15 16:25:05 2013
New Revision: 8

URL: http://svn.shibboleth.net/view/java-idp-testbed?rev=8&view=rev
Log:
Streamline handling of principal name during authn flow, fix up config files.

Modified:
    trunk/src/main/resources/flows/authn/authn-beans.xml
    trunk/src/main/resources/flows/authn/authn-flow.xml

Modified: trunk/src/main/resources/flows/authn/authn-beans.xml
URL: http://svn.shibboleth.net/view/java-idp-testbed/trunk/src/main/resources/flows/authn/authn-beans.xml?rev=8&r1=7&r2=8&view=diff
==============================================================================
--- trunk/src/main/resources/flows/authn/authn-beans.xml (original)
+++ trunk/src/main/resources/flows/authn/authn-beans.xml Tue Oct 15 16:25:05 2013
@@ -36,9 +36,7 @@
     <bean id="SelectAuthenticationFlow" class="net.shibboleth.idp.authn.impl.SelectAuthenticationFlow" scope="prototype"
         p:favorSSO="${idp.authn.favorSSO}" />
     
-    <bean id="FinalizeAuthenticationFlow" class="net.shibboleth.idp.authn.impl.FinalizeAuthenticationFlow" scope="prototype" />
-    
-    <bean id="InvalidateSession" class="net.shibboleth.idp.session.impl.InvalidateSession" scope="prototype"
+    <bean id="InvalidateSessionOnIdentitySwitch" class="net.shibboleth.idp.session.impl.InvalidateSessionOnIdentitySwitch" scope="prototype"
         p:sessionManager-ref="shibboleth.SessionManager" />
     
     <bean id="FinalizeAuthentication" class="net.shibboleth.idp.authn.impl.FinalizeAuthentication" scope="prototype" />

Modified: trunk/src/main/resources/flows/authn/authn-flow.xml
URL: http://svn.shibboleth.net/view/java-idp-testbed/trunk/src/main/resources/flows/authn/authn-flow.xml?rev=8&r1=7&r2=8&view=diff
==============================================================================
--- trunk/src/main/resources/flows/authn/authn-flow.xml (original)
+++ trunk/src/main/resources/flows/authn/authn-flow.xml Tue Oct 15 16:25:05 2013
@@ -54,34 +54,24 @@
 
     <!--
     This invokes an authentication flow to attempt a login. Anything but proceed
-    is an error, otherwise the called flow is finalized.
+    is an error, otherwise control passes to the wrap-up actions.
     -->
     <subflow-state id="CallAuthenticationFlow" subflow="#{currentEvent.id}">
-        <transition on="proceed" to="FinalizeAuthenticationFlow" />
+        <transition on="proceed" to="InvalidateSessionOnIdentitySwitch" />
         
         <transition on="#{true}" to="#{currentEvent.id}" />
     </subflow-state>
-    
-    <!-- This wraps up a fresh login by checking on the result of subject c14n. -->
-    <action-state id="FinalizeAuthenticationFlow">
-        <evaluate expression="FinalizeAuthenticationFlow" />
 
+    <!-- Handles an identity switch by dumping the old session. -->
+    <action-state id="InvalidateSessionOnIdentitySwitch">
+        <evaluate expression="InvalidateSessionOnIdentitySwitch" />
+        
         <transition on="proceed" to="FinalizeAuthentication" />
-        
-        <!-- This can be routed to something more complex if desired. -->
-        <transition on="IdentitySwitch" to="InvalidateSession" />
+        <!-- Ignore any session layer errors at this stage. -->
+        <transition on="InputOutputError" to="FinalizeAuthentication" />
     </action-state>
     
-    <!-- Handles an identity switch by dumping the old session. -->
-    <action-state id="InvalidateSession">
-        <evaluate expression="InvalidateSession" />
-        
-        <!-- Loop back up to finalize flow, guaranteed not to trigger a switch. -->
-        <transition on="proceed" to="FinalizeAuthenticationFlow" />
-        <transition on="InputOutputError" to="FinalizeAuthenticationFlow" />
-    </action-state>
-
-    <!-- Wraps up the subflow by producing a SubjectContext. -->
+    <!-- Wraps up the subflow or result reuse by producing a SubjectContext. -->
     <action-state id="FinalizeAuthentication">
         <evaluate expression="FinalizeAuthentication" />
         
@@ -92,7 +82,7 @@
     <action-state id="UpdateSessionWithAuthenticationResult">
         <evaluate expression="UpdateSessionWithAuthenticationResult" />
         
-        <!-- By default, ignore any session layer errors at this stage. -->
+        <!-- Ignore any session layer errors at this stage. -->
         <transition on="InputOutputError" to="proceed" />
     </action-state>
 
@@ -100,7 +90,6 @@
     <end-state id="proceed" />
 
     <!-- Error events to reflect back from this subflow. -->    
-    <end-state id="IdentitySwitch" />
     <end-state id="InputOutputError" />
     <end-state id="InvalidCredentials" />
     <end-state id="InvalidProfileContext" />