[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthent...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Mar 19 18:54:36 2014
New Revision: 5613

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5613&view=rev
Log:
Set groundwork for handling Subject in SAML 2 AuthnRequest.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-flow.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java?rev=5613&r1=5612&r2=5613&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java (original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java Wed Mar 19 18:54:36 2014
@@ -28,9 +28,13 @@
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.idp.session.context.SessionContext;
 
+import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 
 /**
@@ -43,10 +47,18 @@
  * the completed {@link AuthenticationResult} and any other active results found in the
  * {@link AuthenticationContext}.</p>
  * 
- * <p>Any {@link SubjectCanonicalizationContext} found will be removed.</p> 
+ * <p>Any {@link SubjectCanonicalizationContext} found will be removed.</p>
+ * 
+ * <p>If a {@link SubjectContext} already exists, then this action will validate that
+ * the same principal name is represented by it, and signal a mismatch otherwise. This
+ * is used in protocols that indicate normatively what the authenticated identity is
+ * required to be.</p>
  * 
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * @event {@link IdPEventIds#INVALID_SUBJECT_CTX}
+ * 
  * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null</pre>
+ * 
  * @post If SubjectCanonicalizationContext.getCanonicalPrincipalName() != null
  * || SessionContext.getIdPSession() != null
  * then ProfileRequestContext.getSubcontext(SubjectContext.class) != null 
@@ -55,6 +67,9 @@
  */
 public class FinalizeAuthentication extends AbstractAuthenticationAction {
 
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(FinalizeAuthentication.class);
+    
     /** The principal name extracted from the context tree. */
     @Nullable private String canonicalPrincipalName;
     
@@ -87,6 +102,15 @@
 
         if (canonicalPrincipalName != null) {
             final SubjectContext sc = profileRequestContext.getSubcontext(SubjectContext.class, true);
+            
+            // Check for an existing value.
+            if (sc.getPrincipalName() != null && !canonicalPrincipalName.equals(sc.getPrincipalName())) {
+                log.warn("{} Result of authentication ({}) does not match existing subject in context ({})",
+                        getLogPrefix(), canonicalPrincipalName, sc.getPrincipalName());
+                ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_SUBJECT_CTX);
+                return;
+            }
+            
             sc.setPrincipalName(canonicalPrincipalName);
 
             final Map scResults = sc.getAuthenticationResults();

Modified: trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java?rev=5613&r1=5612&r2=5613&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java (original)
+++ trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java Wed Mar 19 18:54:36 2014
@@ -26,6 +26,7 @@
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.profile.ActionTestingSupport;
+import net.shibboleth.idp.profile.IdPEventIds;
 
 import org.opensaml.profile.ProfileException;
 import org.springframework.webflow.execution.Event;
@@ -50,23 +51,32 @@
         final Event event = action.execute(src);
         
         ActionTestingSupport.assertProceedEvent(event);

[... 113 lines stripped ...]