[java-identity-provider COMMIT] in /trunk/idp-authn-impl/src: main/java/net/shibboleth/idp/authn/impl/PopulateMultiFa...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Apr 26 23:22:02 2016
New Revision: 8219

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8219&view=rev
Log:
IDP-962 - Login flow or framework for combining authentication factors

Finish coding and unit test for initial bootstrap of MFA flow.

Added:
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContextTest.java   (with props)
Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java?rev=8219&r1=8218&r2=8219&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	Tue Apr 26 23:22:02 2016
@@ -17,10 +17,12 @@
 
 package net.shibboleth.idp.authn.impl;
 
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -31,6 +33,7 @@
 import net.shibboleth.idp.authn.MultiFactorAuthenticationTransition;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext;
+import net.shibboleth.idp.authn.principal.AuthenticationResultPrincipal;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -77,6 +80,7 @@
         multiFactorContextCreationStrategy = Functions.compose(
                 new ChildContextLookup(MultiFactorAuthenticationContext.class, true),
                 new ChildContextLookup(AuthenticationContext.class));
+        activeResultLookupStrategy = new DefaultResultLookupStrategy();
     }
     
     /**
@@ -134,29 +138,66 @@
         
         if (activeResultLookupStrategy != null) {
             final Collection<AuthenticationResult> results = activeResultLookupStrategy.apply(profileRequestContext);
-            int count = 0;
-            long now = System.currentTimeMillis();
-            if (results != null && !results.isEmpty()) {
+            if (results != null) {
                 for (final AuthenticationResult result : results) {
-                    final AuthenticationFlowDescriptor descriptor =
-                            authenticationContext.getAvailableFlows().get(result.getAuthenticationFlowId());
-                    if (descriptor != null) {
-                        if (result.getAuthenticationInstant() + descriptor.getLifetime() <= now) {
-                            mfaCtx.getActiveResults().put(descriptor.getId(), result);
-                            ++count;
-                        } else {
-                            log.debug("{} Result from login flow {} has expired", getLogPrefix(), descriptor.getId());
+                    mfaCtx.getActiveResults().put(result.getAuthenticationFlowId(), result);
+                }
+            }
+            log.debug("{} {} active result(s) extracted for possible reuse", getLogPrefix(),
+                    results != null ? results.size() : 0);
+        } else {
+            log.debug("{} No lookup strategy provided, no active results will be made available", getLogPrefix());
+        }
+    }
+    
+    /**
+     * Default strategy function to extract embedded {@link AuthenticationResult}s from inside
+     * the {@link Principal} collection of an active {@link AuthenticationResult} of the currently
+     * executing flow.
+     */
+    private class DefaultResultLookupStrategy
+            implements Function<ProfileRequestContext,Collection<AuthenticationResult>> {
+
+        /** {@inheritDoc} */
+        @Nullable public Collection<AuthenticationResult> apply(@Nullable final ProfileRequestContext input) {
+            
+            if (input != null) {
+                final AuthenticationContext ac = input.getSubcontext(AuthenticationContext.class);
+                if (ac != null && ac.getAttemptedFlow() != null) {
+                    final AuthenticationResult mfaResult = ac.getActiveResults().get(ac.getAttemptedFlow().getId());
+                    if (mfaResult != null) {
+                        final Set<AuthenticationResultPrincipal> resultPrincipals =
+                                mfaResult.getSubject().getPrincipals(AuthenticationResultPrincipal.class);
+                        if (!resultPrincipals.isEmpty()) {
+                            final long now = System.currentTimeMillis();

[... 39 lines stripped ...]