[java-identity-provider COMMIT] in /trunk: idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.ja...

[noreply at shibboleth.net]

Author: serac
Date: Thu Nov  6 15:47:10 2014
New Revision: 6855

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6855&view=rev
Log:
Fail on broken CAS proxy chain.

Modified:
    trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/BuildProxyChainAction.java
    trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/BuildProxyChainActionTest.java
    trunk/idp-conf/src/main/resources/system/flows/cas/proxyValidate/proxyValidate-flow.xml
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ProxyValidateFlowTest.java

Modified: trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java?rev=6855&r1=6854&r2=6855&view=diff
==============================================================================
--- trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java (original)
+++ trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java Thu Nov  6 15:47:10 2014
@@ -26,6 +26,9 @@
  * @author Marvin S. Addison
  */
 public enum ProtocolError {
+
+    /** One or more proxy-granting tickets in proxy chain have expired. */
+    BrokenProxyChain("INVALID_TICKET", "E_BROKEN_PROXY_CHAIN"),
 
     /** Illegal state error. */
     IllegalState("INTERNAL_ERROR", "E_ILLEGAL_STATE"),

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/BuildProxyChainAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/BuildProxyChainAction.java?rev=6855&r1=6854&r2=6855&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/BuildProxyChainAction.java (original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/BuildProxyChainAction.java Thu Nov  6 15:47:10 2014
@@ -35,7 +35,8 @@
  *
  * <ul>
  *     <li>{@link Events#Proceed proceed}</li>
- *     <li>{@link ProtocolError#InvalidTicketType invalidTicketTypew}</li>
+ *     <li>{@link ProtocolError#BrokenProxyChain brokenProxyChain}</li>
+ *     <li>{@link ProtocolError#InvalidTicketType invalidTicketType}</li>
  * </ul>
  *
  * @author Marvin S. Addison
@@ -63,8 +64,8 @@
     @Nonnull
     @Override
     protected Event doExecute(
-    final @Nonnull RequestContext springRequestContext,
-    final @Nonnull ProfileRequestContext profileRequestContext) {
+        final @Nonnull RequestContext springRequestContext,
+        final @Nonnull ProfileRequestContext profileRequestContext) {
 
         final TicketValidationResponse response = getCASResponse(profileRequestContext);
         final Ticket ticket = getCASTicket(profileRequestContext);
@@ -76,6 +77,9 @@
         String pgtId = pt.getPgtId();
         do {
             pgt = ticketService.fetchProxyGrantingTicket(pgtId);
+            if (pgt == null) {
+                return ProtocolError.BrokenProxyChain.event(this);
+            }
             response.addProxy(pgt.getService());
             pgtId = pgt.getParentId();
         } while (pgtId != null);

Modified: trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/BuildProxyChainActionTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/BuildProxyChainActionTest.java?rev=6855&r1=6854&r2=6855&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/BuildProxyChainActionTest.java (original)
+++ trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/BuildProxyChainActionTest.java Thu Nov  6 15:47:10 2014
@@ -18,6 +18,7 @@
 package net.shibboleth.idp.cas.flow;
 
 import net.shibboleth.idp.cas.config.ProxyConfiguration;
+import net.shibboleth.idp.cas.protocol.ProtocolError;
 import net.shibboleth.idp.cas.protocol.TicketValidationRequest;
 import net.shibboleth.idp.cas.protocol.TicketValidationResponse;
 import net.shibboleth.idp.cas.ticket.ProxyGrantingTicket;
@@ -56,4 +57,25 @@
         assertEquals(response.getProxies().get(0), "proxiedByA");
         assertEquals(response.getProxies().get(1), "proxyA");
     }
+
+
+    @Test
+    public void testBrokenProxyChain() throws Exception {
+        final ServiceTicket st = createServiceTicket("proxyA", true);
+        final ProxyGrantingTicket pgtA = createProxyGrantingTicket(st);
+        final ProxyTicket ptA = createProxyTicket(pgtA, "proxiedByA");
+        final ProxyGrantingTicket pgtB = createProxyGrantingTicket(ptA);
+        final ProxyTicket ptB = createProxyTicket(pgtB, "proxiedByB");
+        final TicketValidationRequest request = new TicketValidationRequest("proxiedByB", ptB.getId());
+        final TicketValidationResponse response = new TicketValidationResponse();
+

[... 60 lines stripped ...]