[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticatio...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Sep 16 00:06:20 2015
New Revision: 7756

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7756&view=rev
Log:
IDP-800 - allow reuse of initial authn result when ForceAuthn set

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java?rev=7756&r1=7755&r2=7756&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java	Wed Sep 16 00:06:20 2015
@@ -18,6 +18,7 @@
 package net.shibboleth.idp.authn.impl;
 
 import java.security.Principal;
+import java.util.Collections;
 import java.util.Map;
 
 import javax.annotation.Nonnull;
@@ -31,6 +32,7 @@
 import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicate;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -106,6 +108,10 @@
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext) {
         
+        if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
+            return false;
+        }
+        
         requestedPrincipalCtx = authenticationContext.getSubcontext(RequestedPrincipalContext.class);
         if (requestedPrincipalCtx != null) {
             if (requestedPrincipalCtx.getOperator() == null
@@ -124,7 +130,7 @@
                     authenticationContext.getAttemptedFlow().getId(), authenticationContext.getAttemptedFlow());
         }
         
-        return super.doPreExecute(profileRequestContext, authenticationContext);
+        return true;
     }
     
     /** {@inheritDoc} */
@@ -168,36 +174,45 @@
         
         log.debug("{} Attempting to honor signaled flow {}", getLogPrefix(), flow.getId());
 
-        // If not forced, check for an active result for that flow.
+        // If not forced, or we just did it, check for an active result for that flow.
+
+        final AuthenticationResult activeResult;
         if (!authenticationContext.isForceAuthn()) {
-            final AuthenticationResult activeResult = authenticationContext.getActiveResults().get(flow.getId());
-            if (activeResult != null) {
-                if (requestedPrincipalCtx != null) {
-                    for (final Principal p : requestedPrincipalCtx.getRequestedPrincipals()) {
-                        final PrincipalEvalPredicateFactory factory =
-                                authenticationContext.getPrincipalEvalPredicateFactoryRegistry().lookup(
-                                        p.getClass(), requestedPrincipalCtx.getOperator());
-                        if (factory != null) {
-                            final PrincipalEvalPredicate predicate = factory.getPredicate(p);
-                            if (predicate.apply(activeResult)) {
-                                selectActiveResult(profileRequestContext, authenticationContext, activeResult);
-                                return;
-                            }
-                        } else {
-                            log.warn("{} Configuration does not support requested principal evaluation with "
-                                    + "operator '{}' and type '{}'", getLogPrefix(),
-                                    requestedPrincipalCtx.getOperator(), p.getClass());
+            activeResult = authenticationContext.getActiveResults().get(flow.getId());
+        } else if (authenticationContext.getInitialAuthenticationResult() != null
+                && authenticationContext.getInitialAuthenticationResult().getAuthenticationFlowId().equals(
+                        flow.getId())) {
+            activeResult = authenticationContext.getInitialAuthenticationResult();
+        } else {
+            activeResult = null;
+        }
+        
+        if (activeResult != null) {
+            if (requestedPrincipalCtx != null) {
+                for (final Principal p : requestedPrincipalCtx.getRequestedPrincipals()) {
+                    final PrincipalEvalPredicateFactory factory =
+                            authenticationContext.getPrincipalEvalPredicateFactoryRegistry().lookup(
+                                    p.getClass(), requestedPrincipalCtx.getOperator());
+                    if (factory != null) {
+                        final PrincipalEvalPredicate predicate = factory.getPredicate(p);

[... 89 lines stripped ...]