[java-identity-provider COMMIT] in /trunk: idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.ja...

[noreply at shibboleth.net]

Author: serac
Date: Mon Nov  3 06:53:46 2014
New Revision: 6824

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6824&view=rev
Log:
Fail CAS ticket validation on proxy failure.

Added:
    trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/CheckProxyAuthorizationActionTest.java
    trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/ValidateProxyCallbackActionTest.java
Modified:
    trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/CheckProxyAuthorizationAction.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateProxyCallbackAction.java
    trunk/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml

Modified: trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java?rev=6824&r1=6823&r2=6824&view=diff
==============================================================================
--- trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java (original)
+++ trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java Mon Nov  3 06:53:46 2014
@@ -39,6 +39,12 @@
     /** Generic protocol violation error. */
     ProtocolViolation("INVALID_REQUEST", "E_PROTOCOL_VIOLATION"),
 
+    /** Proxy callback authentication failed. */
+    ProxyCallbackAuthenticationFailure("INVALID_REQUEST", "E_PROXY_CALLBACK_AUTH_FAILURE"),
+
+    /** Unauthorized attempt to request proxy-granting ticket. */
+    ProxyNotAuthorized("INVALID_REQUEST", "E_PROXY_NOT_AUTHORIZED"),
+
     /** Unsupported condition where a proxy ticket validation occurs with the renew flag set. */
     RenewIncompatibleWithProxy("INVALID_REQUEST", "E_RENEW_INCOMPATIBLE_WITH_PROXY"),
 
@@ -53,6 +59,7 @@
 
     /** Error retrieving IdP session. */
     SessionRetrievalError("INVALID_TICKET", "E_SESSION_RETRIEVAL_ERROR"),
+
     /** Ticket parameter required but not specified. */
     TicketNotSpecified("INVALID_REQUEST", "E_TICKET_NOT_SPECIFIED"),
 

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/CheckProxyAuthorizationAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/CheckProxyAuthorizationAction.java?rev=6824&r1=6823&r2=6824&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/CheckProxyAuthorizationAction.java (original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/CheckProxyAuthorizationAction.java Mon Nov  3 06:53:46 2014
@@ -33,7 +33,7 @@
 
 /**
  * Checks the current {@link ServiceContext} to determine whether the service is authorized to proxy.
- * Raises {@link Events#Failure failure}</li> if not authorized.
+ * Raises {@link ProtocolError#ProxyNotAuthorized} if not authorized.
  *
  * @author Marvin S. Addison
  */
@@ -56,7 +56,7 @@
         }
         if (!serviceContext.getService().isAuthorizedToProxy()) {
             log.info("{} is not authorized to proxy", serviceContext.getService().getName());
-            return Events.Failure.event(this);
+            return ProtocolError.ProxyNotAuthorized.event(this);
         }
         return ActionSupport.buildProceedEvent(this);
     }

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateProxyCallbackAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateProxyCallbackAction.java?rev=6824&r1=6823&r2=6824&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateProxyCallbackAction.java (original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateProxyCallbackAction.java Mon Nov  3 06:53:46 2014
@@ -49,7 +49,7 @@
  *
  * <ul>
  *     <li>{@link Events#Success success}</li>
- *     <li>{@link Events#Failure failure}</li>
+ *     <li>{@link ProtocolError#ProxyCallbackAuthenticationFailure}</li>
  * </ul>
  *
  * On success, the PGTIOU is accessible at {@link TicketValidationResponse#getPgtIou()}.
@@ -155,7 +155,7 @@
             response.setPgtIou(proxyIds.getPgtIou());
         } catch (Exception e) {
             log.info("Proxy authentication failed for " + request.getPgtUrl() + ": " + e);
-            return Events.Failure.event(this);
+            return ProtocolError.ProxyCallbackAuthenticationFailure.event(this);
         }
         return Events.Success.event(this);
     }

Modified: trunk/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml?rev=6824&r1=6823&r2=6824&view=diff
==============================================================================

[... 25 lines stripped ...]