[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePassw...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Apr 20 19:50:54 2016
New Revision: 8207

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8207&view=rev
Log:
IDP-960 - Remove or at least null-out UsernamePasswordContext after use

https://issues.shibboleth.net/jira/browse/IDP-960

Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAASTest.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstLDAPTest.java
    trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java?rev=8207&r1=8206&r2=8207&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java	Wed Apr 20 19:50:54 2016
@@ -55,11 +55,19 @@
     /** Whether to save the password in the Java Subject's private credentials. */
     private boolean savePasswordToCredentialSet;
     
+    /** Whether to remove the {@link UsernamePasswordContext} after successful validation. */
+    private boolean removeContextAfterValidation;
+    
     /** A regular expression to apply for acceptance testing. */
     @Nullable private Pattern matchExpression;
     
     /** UsernamePasswordContext containing the credentials to validate. */
     @Nullable private UsernamePasswordContext upContext;
+    
+    /** Constructor. */
+    public AbstractUsernamePasswordValidationAction() {
+        removeContextAfterValidation = true;
+    }
     
     /**
      * Get whether to save the password in the private credential set.
@@ -80,7 +88,35 @@
         
         savePasswordToCredentialSet = flag;
     }
+
+    /**
+     * Get whether to remove the {@link UsernamePasswordContext} after it's
+     * successfully validated.
+     * 
+     * <p>Defaults to true</p>
+     * 
+     * @return whether to remove the context after successful validation
+     * 
+     * @since 3.3.0
+     */
+    public boolean removeContextAfterValidation() {
+        return removeContextAfterValidation;
+    }
     
+    /**
+     * Set whether to remove the {@link UsernamePasswordContext} after it's
+     * successfully validated.
+     * 
+     * @param flag  flag to set
+     * 
+     * @since 3.3.0
+     */
+    public void setRemoveContextAfterValidation(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        removeContextAfterValidation = flag;
+    }
+
     /**
      * Set a matching expression to apply to the username for acceptance. 
      * 
@@ -143,6 +179,13 @@
         if (savePasswordToCredentialSet) {
             subject.getPrivateCredentials().add(new PasswordPrincipal(upContext.getPassword()));
         }
+        
+        if (removeContextAfterValidation) {
+            upContext.getParent().removeSubcontext(upContext);
+            upContext.setPassword(null);
+            upContext = null;
+        }
+        
         return subject;
     }
     

Modified: trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAASTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAASTest.java?rev=8207&r1=8206&r2=8207&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAASTest.java	(original)
+++ trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAASTest.java	Wed Apr 20 19:50:54 2016
@@ -73,7 +73,7 @@
      */
     @BeforeClass public void setupDirectoryServer() throws LDAPException {
 
-        InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=shibboleth,dc=net");
+        final InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=shibboleth,dc=net");
         config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("default", 10389));
         config.addAdditionalBindCredentials("cn=Directory Manager", "password");
         directoryServer = new InMemoryDirectoryServer(config);
@@ -93,7 +93,7 @@
 
         action = new ValidateUsernamePasswordAgainstJAAS();
         
-        Map<String,Collection<String>> mappings = new HashMap<>();
+        final Map<String,Collection<String>> mappings = new HashMap<>();
         mappings.put("UnknownUsername", Collections.singleton("DN_RESOLUTION_FAILURE"));

[... 244 lines stripped ...]