[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContex...

[noreply at shibboleth.net]

Author: scantor
Date: Sat Jun 21 19:03:57 2014
New Revision: 6141

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6141&view=rev
Log:
Deal with case where flow result doesn't meet requested principal that caused flow selection.

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java?rev=6141&r1=6140&r2=6141&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java (original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java Sat Jun 21 19:03:57 2014
@@ -51,8 +51,6 @@
     
     /** Constructor. */
     public SubjectContext() {
-        super();
-        
         authenticationResults = new HashMap(5);
     }
 
@@ -91,7 +89,7 @@
      */
     @Nonnull @Unmodifiable @NonnullElements public List<Subject> getSubjects() {
         List<Subject> composite = new ArrayList<>();
-        for (AuthenticationResult e : getAuthenticationResults().values()) {
+        for (final AuthenticationResult e : getAuthenticationResults().values()) {
             composite.add(e.getSubject());
         }
         return ImmutableList.copyOf(composite);

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java?rev=6141&r1=6140&r2=6141&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java (original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java Sat Jun 21 19:03:57 2014
@@ -17,6 +17,7 @@
 
 package net.shibboleth.idp.authn.impl;
 
+import java.security.Principal;
 import java.util.Map;
 
 import javax.annotation.Nonnull;
@@ -24,7 +25,9 @@
 
 import net.shibboleth.idp.authn.AbstractAuthenticationAction;
 import net.shibboleth.idp.authn.AuthenticationResult;
+import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.profile.IdPEventIds;
@@ -41,6 +44,12 @@
  * of an active result) and transfers information from other contexts into a {@link SubjectContext}
  * child of the {@link ProfileRequestContext}.
  * 
+ * <p>The action also cross-checks {@link RequestedPrincipalContext#getMatchingPrincipal()}, if set,
+ * against the {@link AuthenticationResult} to ensure that the result produced actually satisfies the
+ * request. This is redundant when reusing active results, but is necessary to prevent a flow from running
+ * that can return different results and having it produce a result that doesn't actually satisfy the
+ * request. Such a flow would be buggy, but this guards against a mistake from leaving the subsystem.</p>
+ * 
  * <p>The context is populated based on the presence of a canonical principal name in either
  * a {@link SubjectCanonicalizationContext} or {@link SessionContext}, and also includes
  * the completed {@link AuthenticationResult} and any other active results found in the
@@ -55,6 +64,7 @@
  * 
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
  * @event {@link IdPEventIds#INVALID_SUBJECT_CTX}
+ * @event {@link AuthnEventIds#REQUEST_UNSUPPORTED}
  * 
  * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null</pre>
  * 
@@ -88,6 +98,22 @@
             final SessionContext sessionCtx = profileRequestContext.getSubcontext(SessionContext.class);
             if (sessionCtx != null && sessionCtx.getIdPSession() != null) {
                 canonicalPrincipalName = sessionCtx.getIdPSession().getPrincipalName();
+            }
+        }
+        
+        // Check for a requested Principal and make sure it's in the result.
+        final RequestedPrincipalContext requestedPrincipalCtx =
+                authenticationContext.getSubcontext(RequestedPrincipalContext.class);
+        if (requestedPrincipalCtx != null) {
+            final Principal match = requestedPrincipalCtx.getMatchingPrincipal();
+            if (match != null) {
+                final AuthenticationResult latest = authenticationContext.getAuthenticationResult();

[... 87 lines stripped ...]