[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticatio...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Apr 22 00:05:56 2016
New Revision: 8211

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8211&view=rev
Log:
IDP-980: Reuse of authentication results for SSO is overly constrained

https://issues.shibboleth.net/jira/browse/IDP-980

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java?rev=8211&r1=8210&r2=8211&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java	Fri Apr 22 00:05:56 2016
@@ -160,7 +160,7 @@
             @Nonnull final AuthenticationContext authenticationContext) {
         
         // See if flow exists.
-        final AuthenticationFlowDescriptor flow = authenticationContext.getPotentialFlows().get(
+        final AuthenticationFlowDescriptor flow = authenticationContext.getAvailableFlows().get(
                 authenticationContext.getSignaledFlowId());
         if (flow == null) {
             log.error("{} Signaled flow {} is not available", getLogPrefix(),
@@ -216,7 +216,7 @@
             for (final Principal p : requestedPrincipalCtx.getRequestedPrincipals()) {
                 final PrincipalEvalPredicate predicate = requestedPrincipalCtx.getPredicate(p);
                 if (predicate != null) {
-                    if (predicate.apply(flow)) {
+                    if (predicate.apply(flow) && flow.apply(profileRequestContext)) {
                         selectInactiveFlow(profileRequestContext, authenticationContext, flow);
                         return;
                     }
@@ -226,13 +226,12 @@
                             p.getClass());
                 }
             }
-        } else {
+        } else if (flow.apply(profileRequestContext)) {
             selectInactiveFlow(profileRequestContext, authenticationContext, flow);
             return;
         }
         
-        log.error("{} Signaled flow {} was unusable based on requester's requirements", getLogPrefix(),
-                flow.getId());
+        log.error("{} Signaled flow {} was not applicable to request", getLogPrefix(), flow.getId());
         ActionSupport.buildEvent(profileRequestContext,
                 authenticationContext.isPassive() ? AuthnEventIds.NO_PASSIVE : AuthnEventIds.NO_POTENTIAL_FLOW);
     }
@@ -250,9 +249,7 @@
         log.debug("{} No specific Principals requested", getLogPrefix());
         
         // Check for initial authentication (valid even in presence of forced authentication).
-        if (authenticationContext.getInitialAuthenticationResult() != null
-                && authenticationContext.getPotentialFlows().containsKey(
-                        authenticationContext.getInitialAuthenticationResult().getAuthenticationFlowId())) {
+        if (authenticationContext.getInitialAuthenticationResult() != null) {
             selectActiveResult(profileRequestContext, authenticationContext,
                     authenticationContext.getInitialAuthenticationResult());
             return;
@@ -273,13 +270,10 @@
         }
 
         // Pick a result to reuse if possible.
-        for (final AuthenticationResult activeResult : authenticationContext.getActiveResults().values()) {
-            final AuthenticationFlowDescriptor flow = authenticationContext.getPotentialFlows().get(
-                    activeResult.getAuthenticationFlowId());
-            if (flow != null) {
-                selectActiveResult(profileRequestContext, authenticationContext, activeResult);
-                return;
-            }
+        if (!authenticationContext.getActiveResults().isEmpty()) {
+            selectActiveResult(profileRequestContext, authenticationContext,
+                    authenticationContext.getActiveResults().values().iterator().next());
+            return;
         }
         
         log.debug("{} No usable active results available, selecting an inactive flow", getLogPrefix());
@@ -295,7 +289,8 @@
     }
 
     /**
-     * Return the first inactive potential flow not found in the intermediate flows collection. 
+     * Return the first inactive potential flow not found in the intermediate flows collection that applies
+     * to the request.
      * 
      * @param profileRequestContext the current profile request context
      * @param authenticationContext the current authentication context
@@ -306,7 +301,9 @@
             @Nonnull final AuthenticationContext authenticationContext) {
         for (final AuthenticationFlowDescriptor flow : authenticationContext.getPotentialFlows().values()) {
             if (!authenticationContext.getIntermediateFlows().containsKey(flow.getId())) {

[... 26 lines stripped ...]