[java-identity-provider COMMIT] in /trunk/idp-consent/src: main/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttrib...

[noreply at shibboleth.net]

Author: tzeller
Date: Wed Nov 19 23:49:14 2014
New Revision: 6959

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6959&view=rev
Log:
FIx bug in ReleaseAttributes action where attributes exempt from consent were not released.

Modified:
    trunk/idp-consent/src/main/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributes.java
    trunk/idp-consent/src/test/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributesTest.java

Modified: trunk/idp-consent/src/main/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributes.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-consent/src/main/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributes.java?rev=6959&r1=6958&r2=6959&view=diff
==============================================================================
--- trunk/idp-consent/src/main/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributes.java (original)
+++ trunk/idp-consent/src/main/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributes.java Wed Nov 19 23:49:14 2014
@@ -36,8 +36,10 @@
 /**
  * Attribute consent action which constrains the attributes released to those consented to.
  * 
- * For every IdP attribute in the attribute context, this action will release the attribute iff consent for the
- * attribute has been approved.
+ * For every consentable attribute in the attribute release context, this action will release the attribute if consent
+ * for the attribute has been approved. Attributes in the attribute context which are not consentable attributes in the
+ * attribute release context will be released. In other words, this action releases attributes for which consent has
+ * been approved as well as attributes which are excluded from consent.
  * 
  * Consent is obtained from the consent context. If there are no current consents then the previous consents are used to
  * determine the attributes to be released. The current consents will be present if user input has been obtained during
@@ -64,25 +66,32 @@
         final Map<String, IdPAttribute> attributes = getAttributeContext().getIdPAttributes();
         log.debug("{} Attributes before release '{}'", getLogPrefix(), attributes);
 
-        final Map<String, IdPAttribute> releasedAttributes = new HashMap<String, IdPAttribute>();
+        final Map<String, IdPAttribute> releasedAttributes = new HashMap<>(attributes.size());
 
         for (final IdPAttribute attribute : attributes.values()) {
+            if (!getAttributeReleaseContext().getConsentableAttributes().containsKey(attribute.getId())) {
+                log.debug("{} Attribute '{}' will be released because it is excluded from consent", getLogPrefix(),
+                        attribute);
+                releasedAttributes.put(attribute.getId(), attribute);
+                continue;
+            }
             if (!consents.containsKey(attribute.getId())) {
-                log.debug("{} Unknown attribute '{}' will not be released", getLogPrefix(), attribute);
+                log.debug("{} Attribute '{}' will not be released because consent for it does not exist",
+                        getLogPrefix(), attribute);
                 continue;
             }
             final Consent consent = consents.get(attribute.getId());
             if (consent.isApproved()) {
-                log.debug("{} Release of attribute '{}' is consented to", getLogPrefix(), attribute);
+                log.debug("{} Attribute '{}' will be released because consent is approved", getLogPrefix(), attribute);
                 releasedAttributes.put(attribute.getId(), attribute);
             } else {
-                log.debug("{} Release of attribute '{}' is not consented to", getLogPrefix(), attribute);
+                log.debug("{} Attribute '{}' will not be released because consent is not approved", getLogPrefix(),
+                        attribute);
             }
         }
 
-        log.debug("{} Releasing attributes '{}'", getLogPrefix(), releasedAttributes);
-
         if (log.isDebugEnabled()) {
+            log.debug("{} Releasing attributes '{}'", getLogPrefix(), releasedAttributes);
             final MapDifference<String, IdPAttribute> diff = Maps.difference(attributes, releasedAttributes);
             log.debug("{} Not releasing attributes '{}'", getLogPrefix(), diff.entriesOnlyOnLeft());
         }

Modified: trunk/idp-consent/src/test/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributesTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-consent/src/test/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributesTest.java?rev=6959&r1=6958&r2=6959&view=diff
==============================================================================
--- trunk/idp-consent/src/test/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributesTest.java (original)
+++ trunk/idp-consent/src/test/java/net/shibboleth/idp/consent/flow/ar/ReleaseAttributesTest.java Wed Nov 19 23:49:14 2014
@@ -20,21 +20,29 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import net.shibboleth.idp.attribute.IdPAttribute;

[... 71 lines stripped ...]