[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/DefaultPrin...

[noreply at shibboleth.net]

Author: scantor
Date: Thu May 21 14:52:15 2015
New Revision: 7526

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7526&view=rev
Log:
IDP-699 - incorporate weighting into selection of a matching Principal during Finalize action

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/DefaultPrincipalDeterminationStrategy.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/DefaultPrincipalDeterminationStrategy.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/DefaultPrincipalDeterminationStrategy.java?rev=7526&r1=7525&r2=7526&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/DefaultPrincipalDeterminationStrategy.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/DefaultPrincipalDeterminationStrategy.java	Thu May 21 14:52:15 2015
@@ -119,7 +119,7 @@
         final Set<T> principals = ac.getAuthenticationResult().getSupportedPrincipals(principalType);
         if (principals.isEmpty()) {
             return defaultPrincipal;
-        } else if (principals.size() == 1) {
+        } else if (principals.size() == 1 || weightMap.isEmpty()) {
             return principals.iterator().next();
         }
             

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java?rev=7526&r1=7525&r2=7526&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java	Thu May 21 14:52:15 2015
@@ -18,7 +18,13 @@
 package net.shibboleth.idp.authn.impl;
 
 import java.security.Principal;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -32,8 +38,10 @@
 import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicate;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory;
+import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.idp.session.context.SessionContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -51,6 +59,10 @@
  * request. This is redundant when reusing active results, but is necessary to prevent a flow from running
  * that can return different results and having it produce a result that doesn't actually satisfy the
  * request. Such a flow would be buggy, but this guards against a mistake from leaving the subsystem.</p>
+ * 
+ * <p>If no matching Principal is established, or if the match is no longer valid, the request is
+ * evaluated in conjunction with the {@link AuthenticationResult} to establish a Principal that
+ * does satisfy the request and it is recorded via {@link RequestedPrincipalContext#setMatchingPrincipal()}.</p>
  * 
  * <p>The context is populated based on the presence of a canonical principal name in either
  * a {@link SubjectCanonicalizationContext} or {@link SessionContext}, and also includes
@@ -81,10 +93,37 @@
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(FinalizeAuthentication.class);
     
+    /** A map supplying weighted preference to particular Principals. */
+    @Nonnull @NonnullElements private Map<Principal,Integer> weightMap;
+    
     /** The principal name extracted from the context tree. */
     @Nullable private String canonicalPrincipalName;
     
-// Checkstyle: MethodLength|CyclomaticComplexity OFF
+    /** Constructor. */
+    public FinalizeAuthentication() {
+        weightMap = Collections.emptyMap();
+    }
+    
+    /**
+     * Set the map of Principals to weight values to impose a sort order on any matching Principals
+     * found in the authentication result.
+     * 
+     * @param map   map to set
+     */
+    public void setWeightMap(@Nullable @NonnullElements final Map<Principal,Integer> map) {
+        if (map == null) {
+            weightMap = Collections.emptyMap();
+            return;
+        }
+        
+        weightMap = new HashMap<>(map.size());

[... 176 lines stripped ...]