[java-identity-provider COMMIT] in /trunk: idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProx...

[noreply at shibboleth.net]

Author: serac
Date: Thu Oct 29 12:45:14 2015
New Revision: 7904

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7904&view=rev
Log:
IDP-842 Fix CAS protocol error handling.

https://issues.shibboleth.net/jira/browse/IDP-842
Ensure the TicketValidationRequest is always populated in the PRC, even in
cases where required parameters are missing. Add negative test coverage.

Modified:
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ProxyFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/SamlValidateFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ServiceValidateFlowTest.java

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java?rev=7904&r1=7903&r2=7904&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java	(original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java	Thu Oct 29 12:45:14 2015
@@ -73,27 +73,32 @@
             final @Nonnull ProfileRequestContext profileRequestContext) {
 
         final ParameterMap params = springRequestContext.getRequestParameters();
-        final String service = params.get(ProtocolParam.TargetService.id());
+        String service = params.get(ProtocolParam.TargetService.id());
+        Event result = null;
         if (service == null) {
-            return ProtocolError.ServiceNotSpecified.event(this);
+            service = ProtocolError.ServiceNotSpecified.getDetailCode();
+            result = ProtocolError.ServiceNotSpecified.event(this);
         }
-        final String ticket = params.get(ProtocolParam.Pgt.id());
+        String ticket = params.get(ProtocolParam.Pgt.id());
         if (ticket == null) {
-            return ProtocolError.TicketNotSpecified.event(this);
+            ticket = ProtocolError.TicketNotSpecified.getDetailCode();
+            result = ProtocolError.TicketNotSpecified.event(this);
         }
         final ProxyTicketRequest proxyTicketRequest = new ProxyTicketRequest(ticket, service);
         setCASRequest(profileRequestContext, proxyTicketRequest);
-        try {
-            log.debug("Fetching proxy-granting ticket {}", proxyTicketRequest.getPgt());
-            final ProxyGrantingTicket pgt = ticketService.fetchProxyGrantingTicket(proxyTicketRequest.getPgt());
-            if (pgt == null) {
-                return ProtocolError.TicketExpired.event(this);
+        if (result == null) {
+            try {
+                log.debug("Fetching proxy-granting ticket {}", proxyTicketRequest.getPgt());
+                final ProxyGrantingTicket pgt = ticketService.fetchProxyGrantingTicket(proxyTicketRequest.getPgt());
+                if (pgt == null) {
+                    return ProtocolError.TicketExpired.event(this);
+                }
+                setCASTicket(profileRequestContext, pgt);
+            } catch (RuntimeException e) {
+                log.error("Failed looking up " + proxyTicketRequest.getPgt(), e);
+                return ProtocolError.TicketRetrievalError.event(this);
             }
-            setCASTicket(profileRequestContext, pgt);
-        } catch (RuntimeException e) {
-            log.error("Failed looking up " + proxyTicketRequest.getPgt(), e);
-            return ProtocolError.TicketRetrievalError.event(this);
         }
-        return null;
+        return result;
     }
 }

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java?rev=7904&r1=7903&r2=7904&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java	(original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java	Thu Oct 29 12:45:14 2015
@@ -48,13 +48,16 @@
             final @Nonnull ProfileRequestContext profileRequestContext) {
 
         final ParameterMap params = springRequestContext.getRequestParameters();
-        final String service = params.get(ProtocolParam.Service.id());
+        String service = params.get(ProtocolParam.Service.id());
+        Event result = null;
         if (service == null) {

[... 238 lines stripped ...]