[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFact...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Dec 15 15:55:38 2016
New Revision: 8582

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8582&view=rev
Log:
IDP-1098 - C14n failure glitch during MFA transition

https://issues.shibboleth.net/jira/browse/IDP-1098

Explicitly discard authn results on non-proceed events.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java?rev=8582&r1=8581&r2=8582&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	Thu Dec 15 15:55:38 2016
@@ -169,7 +169,9 @@
         
         return true;
     }
-    
+
+
+// Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -177,13 +179,23 @@
         
         // Swap MFA flow back into top-level context so that other components see only MFA flow.
         authenticationContext.setAttemptedFlow(mfaContext.getAuthenticationFlowDescriptor());
-        
+
+        // Event transitions require normalizing empty/null events into "proceed".
+        final EventContext eventCtx = eventContextLookupStrategy.apply(profileRequestContext);
+        final String previousEvent = eventCtx != null && eventCtx.getEvent() != null
+                ? eventCtx.getEvent().toString() : EventIds.PROCEED_EVENT_ID;
+
         // Check for an authentication result and move it into the MFA context.
         final AuthenticationResult result = authenticationContext.getAuthenticationResult();
         if (result != null) {
-            log.debug("{} Preserving authentication result from '{}' flow", getLogPrefix(),
-                    result.getAuthenticationFlowId());
-            mfaContext.getActiveResults().put(result.getAuthenticationFlowId(), result);
+            if (EventIds.PROCEED_EVENT_ID.equals(previousEvent)) {                
+                log.debug("{} Preserving authentication result from '{}' flow", getLogPrefix(),
+                        result.getAuthenticationFlowId());
+                mfaContext.getActiveResults().put(result.getAuthenticationFlowId(), result);
+            } else {
+                log.debug("{} Discarding incomplete authentication result from '{}' flow", getLogPrefix(),
+                        result.getAuthenticationFlowId());
+            }
             authenticationContext.setAuthenticationResult(null);
         }
 
@@ -197,11 +209,6 @@
             log.debug("{} Applying MFA transition rule to exit state '{}'", getLogPrefix(), prevFlowId);
         }
 
-        // Event transitions require normalizing empty/null events into "proceed".
-        final EventContext eventCtx = eventContextLookupStrategy.apply(profileRequestContext);
-        final String previousEvent = eventCtx != null && eventCtx.getEvent() != null
-                ? eventCtx.getEvent().toString() : EventIds.PROCEED_EVENT_ID;
-                
         String flowId = null;
         final MultiFactorAuthenticationTransition transition = mfaContext.getTransitionMap().get(prevFlowId);
         if (transition != null) {
@@ -224,6 +231,7 @@
             }
         }
     }
+// Checkstyle: CyclomaticComplexity ON
 
 // Checkstyle: CyclomaticComplexity|ReturnCount OFF
     /**