[java-identity-provider COMMIT] in /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl: PopulateMultiFa...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Aug 29 20:48:19 2016
New Revision: 8359

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8359&view=rev
Log:
IDP-962 - Login flow or framework for combining authentication factors

Very minimal support for individual factor timeouts.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java?rev=8359&r1=8358&r2=8359&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	Mon Aug 29 20:48:19 2016
@@ -194,6 +194,11 @@
                             final Collection<AuthenticationResult> results = new ArrayList<>(resultPrincipals.size());
                             
                             for (final AuthenticationResultPrincipal resultPrincipal : resultPrincipals) {
+                                // Reset the last-used time to match the MFA result.
+                                // This makes longer timeouts irrelevant but might honor a shorter timeout in
+                                // a small number of edge cases.
+                                resultPrincipal.getAuthenticationResult().setLastActivityInstant(
+                                        mfaResult.getLastActivityInstant());
                                 processActiveResult(ac, results, resultPrincipal.getAuthenticationResult());
                             }
                             
@@ -220,11 +225,10 @@
             final AuthenticationFlowDescriptor descriptor = authenticationContext.getAvailableFlows().get(
                     candidate.getAuthenticationFlowId());
             if (descriptor != null) {
-                if (candidate.getAuthenticationInstant() + descriptor.getLifetime() > System.currentTimeMillis()) {
+                if (descriptor.isResultActive(candidate)) {
                     results.add(candidate);
                 } else {
-                    log.debug("{} Result from login flow {} has expired", getLogPrefix(),
-                            descriptor.getId());
+                    log.debug("{} Result from login flow {} has expired", getLogPrefix(), descriptor.getId());
                 }
             } else {
                 log.warn("{} Ignoring active result from undefined login flow {}", getLogPrefix(),

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java?rev=8359&r1=8358&r2=8359&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	Mon Aug 29 20:48:19 2016
@@ -257,8 +257,10 @@
         // constraint is assumed to be enforced by limiting which active results are made available.
         // To bypass, we just call ourselves again, implicitly looping back. The protection against
         // infinite recursion is the configuration of transitions supplied by the deployer.
-        if (mfaContext.getActiveResults().containsKey(flowId)) {
+        final AuthenticationResult activeResult = mfaContext.getActiveResults().get(flowId);
+        if (activeResult != null) {
             log.debug("{} Reusing active result for '{}' flow", getLogPrefix(), flowId);
+            activeResult.setLastActivityInstantToNow();
             ActionSupport.buildProceedEvent(profileRequestContext);
             doExecute(profileRequestContext, authenticationContext);
             return;