[java-identity-provider COMMIT] /trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationCon...

[noreply at shibboleth.net]

Author: scantor
Date: Fri May 22 10:42:55 2015
New Revision: 7529

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7529&view=rev
Log:
IDP-699 - Correct helper method, predicates need to be derived from the requested principals, not the candidate

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java?rev=7529&r1=7528&r2=7529&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java	Fri May 22 10:42:55 2015
@@ -361,25 +361,30 @@
     public <T extends Principal> boolean isAcceptable(@Nonnull final T principal) {
         final RequestedPrincipalContext rpCtx = getSubcontext(RequestedPrincipalContext.class);
         if (rpCtx != null) {
-            final PrincipalEvalPredicateFactory factory =
-                    evalRegistry.lookup(principal.getClass(), rpCtx.getOperator());
-            if (factory != null) {
-                
-                final PrincipalSupportingComponent pseudoComponent = new PrincipalSupportingComponent() {
-                    public <TT extends Principal> Set<TT> getSupportedPrincipals(Class<TT> c) {
-                        return Collections.<TT>singleton((TT) principal);
-                    }
-                };
-                
-                for (final Principal requestedPrincipal : rpCtx.getRequestedPrincipals()) {
+            // Wrap candidate in the collection interface needed to drive the predicates.
+            final PrincipalSupportingComponent pseudoComponent = new PrincipalSupportingComponent() {
+                public <TT extends Principal> Set<TT> getSupportedPrincipals(Class<TT> c) {
+                    return Collections.<TT>singleton((TT) principal);
+                }
+            };
+            
+            for (final Principal requestedPrincipal : rpCtx.getRequestedPrincipals()) {
+                final PrincipalEvalPredicateFactory factory =
+                        evalRegistry.lookup(requestedPrincipal.getClass(), rpCtx.getOperator());
+                if (factory != null) {
                     if (factory.getPredicate(requestedPrincipal).apply(pseudoComponent)) {
                         return true;
                     }
                 }
             }
+            
+            // Nothing matched the candidate.
             return false;
+            
+        } else {
+            // No requirements so anything is acceptable.
+            return true;
         }
-        return true;
     }
     
     /** {@inheritDoc} */