[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAct...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Sep 25 18:35:58 2015
New Revision: 7784

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7784&view=rev
Log:
IDP-821 - Expose capability to override Principal set for password validation step

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
    trunk/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java?rev=7784&r1=7783&r2=7784&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java	Fri Sep 25 18:35:58 2015
@@ -213,16 +213,23 @@
      * Set supported non-user-specific principals that the action will include in the subjects
      * it generates, in place of any default principals from the flow.
      * 
+     * <p>Setting to a null or empty collection will maintain the default behavior of relying on the flow.</p>
+     * 
      * @param <T> a type of principal to add, if not generic
      * @param principals supported principals to include
      */
-    public <T extends Principal> void setSupportedPrincipals(@Nonnull @NonnullElements final Collection<T> principals) {
+    public <T extends Principal> void setSupportedPrincipals(
+            @Nullable @NonnullElements final Collection<T> principals) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-        Constraint.isNotNull(principals, "Principal collection cannot be null");
-        
-        addDefaultPrincipals = false;
+        
         authenticatedSubject.getPrincipals().clear();
-        authenticatedSubject.getPrincipals().addAll(Collections2.filter(principals, Predicates.notNull()));
+        
+        if (principals != null && !principals.isEmpty()) {
+            addDefaultPrincipals = false;
+            authenticatedSubject.getPrincipals().addAll(Collections2.filter(principals, Predicates.notNull()));
+        } else {
+            addDefaultPrincipals = true;
+        }
     }
  
     /**

Modified: trunk/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/authn/password-authn-config.xml?rev=7784&r1=7783&r2=7784&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/authn/password-authn-config.xml	(original)
+++ trunk/idp-conf/src/main/resources/conf/authn/password-authn-config.xml	Fri Sep 25 18:35:58 2015
@@ -77,4 +77,20 @@
         </entry>
     </util:map>
 
+    <!--
+    Uncomment to specify a different set of Principals to inject into results than the list defined on the
+    Password flow itself. You would use this is you need the Password flow to run as a shell to run other
+    login methods, but want to limit its own results more narrowly.
+    -->
+    <!--
+    <util:list id="shibboleth.authn.Password.PrincipalOverride">
+        <bean parent="shibboleth.SAML2AuthnContextClassRef"
+            c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
+        <bean parent="shibboleth.SAML2AuthnContextClassRef"
+            c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
+        <bean parent="shibboleth.SAML1AuthenticationMethod"
+            c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
+    </util:list>
+    -->
+    
 </beans>

Modified: trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml?rev=7784&r1=7783&r2=7784&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml	Fri Sep 25 18:35:58 2015
@@ -51,7 +51,13 @@
             class="net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS" scope="prototype"
             p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') != null ? getObject('shibboleth.authn.Password.RetainAsPrivateCredential') : false}"
             p:loginConfigNames-ref="shibboleth.authn.JAAS.LoginConfigNames" p:loginConfigType="JavaLoginConfig"
-            p:addDefaultPrincipals="#{getObject('shibboleth.authn.Password.addDefaultPrincipals') != null ? getObject('shibboleth.authn.Password.addDefaultPrincipals') : true}"
+            p:addDefaultPrincipals="#{

[... 40 lines stripped ...]