[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthentica...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Jul  6 21:49:47 2016
New Revision: 8284

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8284&view=rev
Log:
IDP-962 - Login flow or framework for combining authentication factors (e.g. Duo)

https://issues.shibboleth.net/jira/browse/IDP-962

Checkpoint some redesign work on MFA flow.
Add utility flow for attribute resolution, still work TBD.

Added:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeMultiFactorAuthentication.java   (with props)
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeMultiFactorAuthenticationTest.java   (with props)
    trunk/idp-conf/src/main/resources/system/flows/util/
    trunk/idp-conf/src/main/resources/system/flows/util/attribute-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/util/attribute-flow.xml
Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/MultiFactorAuthenticationContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransitionTest.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/BaseMultiFactorAuthenticationContextTest.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthenticationTest.java
    trunk/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml
    trunk/idp-conf/src/main/resources/system/conf/utilities.xml
    trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/mfa-authn-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/mfa-authn-flow.xml

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java?rev=8284&r1=8283&r2=8284&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java	Wed Jul  6 21:49:47 2016
@@ -17,20 +17,13 @@
 
 package net.shibboleth.idp.authn;
 
-import java.security.Principal;
-import java.util.ArrayList;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
-import javax.security.auth.Subject;
 
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext;
-import net.shibboleth.idp.authn.principal.AuthenticationResultPrincipal;
 import net.shibboleth.utilities.java.support.annotation.constraint.Live;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -42,83 +35,28 @@
 import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Function;
-import com.google.common.base.Predicate;
 
 /**
- * A ruleset for managing the transition out of an authentication factor during the multi-factor authn flow.
+ * A ruleset for managing the transition out of a step during the multi-factor authn flow.
  * 
- * <p>After each factor is successfully completed, this object supplies rules for determining whether additional
- * factors are required, how to combine {@link Subject}s produced by different factors when a flow completes,
- * and what should happen next.</p>
+ * <p>After each step/flow is successfully completed, this object supplies rules for determining what to
+ * do next with a bit of pseudo-SWF reinvention that allows an event to be mapped to a new flow to run by
+ * means of a function. If no mapping exists, or the function returns null, then the active event is simply
+ * raised as the result of the overall flow execution.</p>
  * 
- * <p>The latter is handled with a bit of pseudo-SWF reinvention that allows an event to be mapped to a new
- * flow to run by means of a function. If no mapping exists, or the function returns null, then the event
- * is simply raised as the result of the overall flow execution.</p>
- * 
- * <p>A generic map can be used to pass data into flows, and allowing flows to be run with different inputs.</p>
+ * <p>Note that raising the "proceed" event from a previous step will cause the MFA flow itself to attempt
+ * successful completion by finalizing its result.</p>
  * 
  * @since 3.3.0
  */
 public class MultiFactorAuthenticationTransition {
-
-    /** Determines whether authentication has completed or not. */
-    @Nonnull private Predicate<ProfileRequestContext> completionCondition;
-        

[... 782 lines stripped ...]