[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthent...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Jul 30 19:53:34 2014
New Revision: 6366

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6366&view=rev
Log:
IDP-455: move per-flow predicate eval to Populate action, add signaling between login flows

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-abstract-flow.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java?rev=6366&r1=6365&r2=6366&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java (original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java Wed Jul 30 19:53:34 2014
@@ -49,10 +49,11 @@
  * 
  * <p>The set of flows will be filtered by {@link AuthenticationProfileConfiguration#getAuthenticationFlows()}
  * if such a configuration is available from a {@link RelyingPartyContext} obtained via a lookup strategy,
- * by default the child of the {@link ProfileRequestContext}.</p>
+ * by default the child of the {@link ProfileRequestContext}. Each flow's attached predicate is also
+ * applied.</p>
  * 
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class, false) != null</pre>
+ * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null</pre>
  * @post The AuthenticationContext is modified as above.
  */
 public class PopulateAuthenticationContext extends AbstractAuthenticationAction {
@@ -161,7 +162,12 @@
                 && !authenticationProfileConfig.getAuthenticationFlows().isEmpty()) {
             for (final AuthenticationFlowDescriptor desc : availableFlows) {
                 if (authenticationProfileConfig.getAuthenticationFlows().contains(desc.getId())) {
-                    authenticationContext.getPotentialFlows().put(desc.getId(), desc);
+                    if (desc.apply(profileRequestContext)) {
+                        authenticationContext.getPotentialFlows().put(desc.getId(), desc);
+                    } else {
+                        log.debug("{} Filtered out authentication flow {} due to attached condition", getLogPrefix(),
+                                desc.getId());
+                    }
                 } else {
                     log.debug("{} Filtered out authentication flow {} due to profile configuration", getLogPrefix(),
                             desc.getId());
@@ -169,7 +175,12 @@
             }
         } else {
             for (final AuthenticationFlowDescriptor desc : availableFlows) {
-                authenticationContext.getPotentialFlows().put(desc.getId(), desc);
+                if (desc.apply(profileRequestContext)) {
+                    authenticationContext.getPotentialFlows().put(desc.getId(), desc);
+                } else {
+                    log.debug("{} Filtered out authentication flow {} due to attached condition", getLogPrefix(),
+                            desc.getId());
+                }
             }
         }
 

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java?rev=6366&r1=6365&r2=6366&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java (original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java Wed Jul 30 19:53:34 2014
@@ -46,26 +46,28 @@
  * the {@link RequestedPrincipalContext} (if any), and the active results, to decide how
  * to proceed.</p>
  * 
- * <p>If there is no {@link RequestedPrincipalContext}, then an active result will be
- * reused with the default "proceed" event returned, unless the request requires forced
- * authentication. If not possible, then a potential flow will be selected and its ID
- * returned as the result of the action.</p>
+ * <p>Normal processing behavior can be circumvented if {@link AuthenticationContext#getSignaledFlowId()}
+ * is set, which causes an active result from that flow to be reused, or that flow to be invoked, if at
+ * all possible, subject to the usual predicates and requested principal constraints noted below.</p>
+ * 
+ * <p>Otherwise, if there is no {@link RequestedPrincipalContext}, then an active result will be
+ * reused, unless the request requires forced authentication. If not possible, then a potential

[... 232 lines stripped ...]