[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/ExternalAuthenticatio...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Jun 22 10:46:42 2015
New Revision: 7587

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7587&view=rev
Log:
IDP-748 - Add standardized way for external login to signal consent revocation

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/ExternalAuthentication.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExternalAuthenticationImpl.java
    trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/interceptor/ProfileInterceptorFlowDescriptor.java

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/ExternalAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/ExternalAuthentication.java?rev=7587&r1=7586&r2=7587&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/ExternalAuthentication.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/ExternalAuthentication.java	Mon Jun 22 10:46:42 2015
@@ -53,7 +53,14 @@
 
     /** Request attribute to which a signal not to cache the result may be bound. */
     @Nonnull @NotEmpty public static final String DONOTCACHE_KEY = "doNotCache";
-    
+
+    /**
+     * Request attribute to which a signal to revoke consent for attribute release may be bound.
+     * 
+     * @since 3.2.0
+     */
+    @Nonnull @NotEmpty public static final String REVOKECONSENT_KEY = "revokeConsent";
+
     /** Request attribute that indicates whether the authentication request requires forced authentication. */
     @Nonnull @NotEmpty public static final String FORCE_AUTHN_PARAM = "forceAuthn";
 

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExternalAuthenticationImpl.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExternalAuthenticationImpl.java?rev=7587&r1=7586&r2=7587&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExternalAuthenticationImpl.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExternalAuthenticationImpl.java	Mon Jun 22 10:46:42 2015
@@ -39,6 +39,7 @@
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
 /**
@@ -157,7 +158,13 @@
             extContext.setDoNotCache((Boolean) attr);
         }
         
-        response.sendRedirect(extContext.getFlowExecutionUrl());
+        attr = request.getAttribute(REVOKECONSENT_KEY);
+        if (attr != null && attr instanceof Boolean && ((Boolean) attr).booleanValue()) {
+            response.sendRedirect(extContext.getFlowExecutionUrl()
+                    + "&" + ProfileInterceptorFlowDescriptor.REVOKE_CONSENT_PARAM + "=1");        
+        } else {
+            response.sendRedirect(extContext.getFlowExecutionUrl());
+        }
     }
 // Checkstyle: CyclomaticComplexity OFF
 

Modified: trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/interceptor/ProfileInterceptorFlowDescriptor.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/interceptor/ProfileInterceptorFlowDescriptor.java?rev=7587&r1=7586&r2=7587&view=diff
==============================================================================
--- trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/interceptor/ProfileInterceptorFlowDescriptor.java	(original)
+++ trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/interceptor/ProfileInterceptorFlowDescriptor.java	Mon Jun 22 10:46:42 2015
@@ -47,6 +47,14 @@
     /** Prefix convention for flow IDs. */
     @Nonnull @NotEmpty public static final String FLOW_ID_PREFIX = "intercept/";
 
+    /**
+     * A standardized parameter to signal revocation of prior consent for any interceptor flows
+     * implementing such.
+     * 
+     * @since 3.2.0
+     */
+    @Nonnull @NotEmpty public static final String REVOKE_CONSENT_PARAM = "_shib_idp_revokeConsent";
+    
     /** Predicate that must be true for this flow to be usable for a given request. */
     @Nonnull private Predicate<ProfileRequestContext> activationCondition;