[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/Authenticatio...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Sep  9 21:41:28 2015
New Revision: 7737

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7737&view=rev
Log:
IDP-810 - idp.authn.resolveAttribute not always honored properly

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FilterFlowsByAttribute.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FilterFlowsByAttributeTest.java
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java?rev=7737&r1=7736&r2=7737&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java	Wed Sep  9 21:41:28 2015
@@ -36,7 +36,6 @@
 import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
@@ -44,7 +43,6 @@
 import org.opensaml.messaging.context.BaseContext;
 
 import com.google.common.base.MoreObjects;
-import com.google.common.collect.ImmutableMap;
 
 /**
  * A context representing the state of an authentication attempt, this is the primary
@@ -119,8 +117,8 @@
      * 
      * @return authentication results currently active for the subject
      */
-    @Nonnull @NonnullElements @Unmodifiable public Map<String,AuthenticationResult> getActiveResults() {
-        return ImmutableMap.copyOf(activeResults);
+    @Nonnull @NonnullElements @Live public Map<String,AuthenticationResult> getActiveResults() {
+        return activeResults;
     }
 
     /**

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FilterFlowsByAttribute.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FilterFlowsByAttribute.java?rev=7737&r1=7736&r2=7737&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FilterFlowsByAttribute.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FilterFlowsByAttribute.java	Wed Sep  9 21:41:28 2015
@@ -32,7 +32,9 @@
 import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.authn.AbstractAuthenticationAction;
 import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
+import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
@@ -48,15 +50,14 @@
  * An authentication action that filters out potential authentication flows by comparing an {@link IdPAttribute}'s
  * values to the custom principals supported by each flow.
  * 
- * <p>
- * The type of principals is ignored, and only string-based values of an attribute are supported.
- * </p>
+ * <p>It optionally (and by default) filters out active {@link AuthenticationResult} objects from possible reuse
+ * for SSO.</p>
+ * 
+ * <p>The type of principals is ignored, and only string-based values of an attribute are supported.</p>
  * 
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- * @pre <pre>
- * ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null
- * </pre>
- * @post AuthenticationContext.getPotentialFlows() is modified as above.
+ * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null</pre>
+ * @post AuthenticationContext.getPotentialFlows() and AuthenticationContext.getActiveResults() are modified as above.
  */
 public class FilterFlowsByAttribute extends AbstractAuthenticationAction {
 
@@ -68,6 +69,9 @@
 
     /** The attribute ID to look for. */
     @Nullable private String attributeId;
+    
+    /** Whether to also filter active results to limit SSO. */
+    private boolean filterActiveResults;
 
     /** The attribute to match against. */
     @Nullable private IdPAttribute attribute;
@@ -78,6 +82,7 @@
                 Functions.compose(new ChildContextLookup<>(AttributeContext.class),
                         new ChildContextLookup<ProfileRequestContext, AuthenticationContext>(

[... 252 lines stripped ...]