[java-identity-provider COMMIT] /trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAu...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Aug 16 20:49:26 2016
New Revision: 8326

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8326&view=rev
Log:
IDP-962 - Login flow or framework for combining authentication factors

Revert a change made early in the design process, which breaks the
authenticationFlows profile config setting by cross-contaminating
results between SPs. The MFA flow manages its own active results now,
so the reason for this change was overtaken by the design.

Modified:
    trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java

Modified: trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java?rev=8326&r1=8325&r2=8326&view=diff
==============================================================================
--- trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java	(original)
+++ trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java	Tue Aug 16 20:49:26 2016
@@ -44,8 +44,10 @@
  * {@link AuthenticationResult} objects found in a {@link SessionContext} that is a direct
  * child of the {@link ProfileRequestContext}.
  * 
- * <p>The active results must correspond to an available {@link AuthenticationFlowDescriptor},
- * but the flow need not be explicitly "runnable" (i.e. in the set of potential flows).</p>
+ * <p>Only results from flows in the "potentialFlows" collection in the {@link AuthenticationContext}
+ * are extracted, which prevents cross-contamination between SPs that have differing rules established
+ * for which flows are to be active, because the potentialFlows collection is filtered by that
+ * criterion.</p>
  * 
  * <p>If {@link AuthenticationContext#getHintedName() is null, then it is populated with the
  * principal name from the session.</p>
@@ -111,7 +113,7 @@
         final List<AuthenticationResult> actives = new ArrayList<>();
         for (final AuthenticationResult result : session.getAuthenticationResults()) {
             final AuthenticationFlowDescriptor descriptor =
-                    authenticationContext.getAvailableFlows().get(result.getAuthenticationFlowId());
+                    authenticationContext.getPotentialFlows().get(result.getAuthenticationFlowId());
             if (descriptor == null) {
                 log.debug("{} Authentication result {} has no corresponding flow descriptor, considering inactive", 
                         getLogPrefix(), result.getAuthenticationFlowId());