[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/error-mappings.xml conf/messages.properti...

[noreply at shibboleth.net]

Author: scantor
Date: Sun Oct 26 16:47:32 2014
New Revision: 6788

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6788&view=rev
Log:
- Reimplement attr-checker flow as an intercept that eval's a predicate
- Wire intercepts into SAML 1 SSO
- Fix error propagation out of master intercept flow

Added:
    trunk/idp-conf/src/main/resources/system/flows/intercept/context-check-beans.xml   (with props)
    trunk/idp-conf/src/main/resources/system/flows/intercept/context-check-flow.xml   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/error-mappings.xml
    trunk/idp-conf/src/main/resources/conf/messages.properties
    trunk/idp-conf/src/main/resources/conf/profile-intercept.xml
    trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml
    trunk/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
    trunk/idp-conf/src/main/resources/views/error.vm

Modified: trunk/idp-conf/src/main/resources/conf/error-mappings.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/error-mappings.xml?rev=6788&r1=6787&r2=6788&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/error-mappings.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/error-mappings.xml Sun Oct 26 16:47:32 2014
@@ -23,12 +23,13 @@
     </util:map>
 
     <!-- List of events to trap and handle with local views, without returning to SPs. -->
-    <!--
     <util:list id="shibboleth.LocalEvents">
+        <value>ContextCheckDenied</value>
+        <!--
         <value>IdentitySwitch</value>
         <value>NoPotentialFlow</value>
+        -->
     </util:list>
-    -->
     
     <!-- Mappings of error events during requests to SAML status codes and SOAP fault codes. -->
 

Modified: trunk/idp-conf/src/main/resources/conf/messages.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/messages.properties?rev=6788&r1=6787&r2=6788&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/messages.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/messages.properties Sun Oct 26 16:47:32 2014
@@ -1,6 +1,8 @@
 # Event to error key mappings
 
 AccessDenied = access
+
+ContextCheckDenied = context-check-denied
 
 AsyncLogout = async-logout
 
@@ -45,6 +47,9 @@
 access.title = Access Denied
 access.message = You do not have access to the requested resource.
 
+context-check-denied.title = Access Denied
+context-check-denied.message = You are not eligible for the service requested.
+
 async-logout.title = Logout Completed
 async-logout.message = Logout complete. Service provider requested no response.
 

Modified: trunk/idp-conf/src/main/resources/conf/profile-intercept.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/profile-intercept.xml?rev=6788&r1=6787&r2=6788&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/profile-intercept.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/profile-intercept.xml Sun Oct 26 16:47:32 2014
@@ -14,6 +14,8 @@
 
     <!-- Flows executed after authentication. -->
     <util:list id="shibboleth.InterceptFlows">
+
+        <bean id="intercept/context-check" parent="shibboleth.InterceptFlow" />
 
         <bean id="intercept/terms-of-use" parent="shibboleth.consent.TermsOfUseFlow" />
 
@@ -56,4 +58,8 @@
         c:regex="^exampleAttribute.*$" />
      -->
 
+    <!-- Condition to evaluate to interrupt SSO flows to check the state of the transaction before allowing. -->
+    <!-- TODO: turn into legit predicate checking attributes -->
+    <bean id="shibboleth.context-check.Condition" class="com.google.common.base.Predicates" factory-method="alwaysTrue" />
+    
 </beans>

Modified: trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml?rev=6788&r1=6787&r2=6788&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml Sun Oct 26 16:47:32 2014
@@ -108,6 +108,9 @@
         <webflow:flow-location id="terms-of-use.abstract" path="../system/flows/intercept/terms-of-use-abstract-flow.xml" />
         <webflow:flow-location id="attribute-release.abstract" path="../system/flows/intercept/attribute-release-abstract-flow.xml" />
 
+        <!-- Built-in intercept flows. -->
+        <webflow:flow-location id="intercept/context-check" path="../system/flows/intercept/context-check-flow.xml" />
+

[... 85 lines stripped ...]