[java-identity-provider COMMIT] in /trunk: idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTi...

[noreply at shibboleth.net]

Author: serac
Date: Wed Jul 13 15:36:01 2016
New Revision: 8294

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8294&view=rev
Log:
IDP-1007 Fix CAS gateway bug.

In the case of attempting to grant a ticket in an SSO context, fetch the
latest AuthenticationResult from the IdPSession instead of requiring an
AuthenticationContext that by design doesn't exist.

Modified:
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java?rev=8294&r1=8293&r2=8294&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java	(original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java	Wed Jul 13 15:36:01 2016
@@ -20,6 +20,7 @@
 import javax.annotation.Nonnull;
 
 import com.google.common.base.Function;
+import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.cas.config.impl.ConfigLookupFunction;
 import net.shibboleth.idp.cas.config.impl.LoginConfiguration;
@@ -95,8 +96,11 @@
                     "Invalid service ticket configuration: SecurityConfiguration#idGenerator undefined");
         }
         final AuthenticationContext authnCtx = authnCtxLookupFunction.apply(profileRequestContext);
-        if (authnCtx == null) {
-            throw new IllegalStateException("AuthenticationContext not found");
+        final AuthenticationResult authnResult;
+        if (authnCtx != null) {
+            authnResult = authnCtx.getAuthenticationResult();
+        } else {
+            authnResult = getLatestAuthenticationResult(session);
         }
         final ServiceTicket ticket;
         try {
@@ -104,8 +108,8 @@
             final TicketState state = new TicketState(
                     session.getId(),
                     session.getPrincipalName(),
-                    new Instant(authnCtx.getAuthenticationResult().getAuthenticationInstant()),
-                    authnCtx.getAuthenticationResult().getAuthenticationFlowId());
+                    new Instant(authnResult.getAuthenticationInstant()),
+                    authnResult.getAuthenticationFlowId());
             ticket = ticketService.createServiceTicket(
                     config.getSecurityConfiguration().getIdGenerator().generateIdentifier(),
                     DateTime.now().plus(config.getTicketValidityPeriod()).toInstant(),
@@ -124,4 +128,26 @@
         setCASResponse(profileRequestContext, response);
         return null;
     }
+
+    /**
+     * Gets the most recent authentication result from the IdP session.
+     *
+     * @param session IdP session to ask for authentication results.
+     *
+     * @return Latest authentication result.
+     *
+     * @throws IllegalStateException If no authentication results are found.
+     */
+    private AuthenticationResult getLatestAuthenticationResult(IdPSession session) {
+        AuthenticationResult latest = null;
+        for (final AuthenticationResult result : session.getAuthenticationResults()) {
+            if (latest == null || result.getAuthenticationInstant() > latest.getAuthenticationInstant()) {
+                latest = result;
+            }
+        }
+        if (latest == null) {
+            throw new IllegalStateException("Cannot find authentication results in IdP session");
+        }
+        return latest;
+    }
 }

Modified: trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java?rev=8294&r1=8293&r2=8294&view=diff
==============================================================================
--- trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java	(original)
+++ trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java	Wed Jul 13 15:36:01 2016
@@ -103,6 +103,7 @@
         final IdPSession existing = sessionManager.createSession("aurora");
         existing.addAuthenticationResult(new AuthenticationResult("authn/Password", new UsernamePrincipal("aurora")));
         externalContext.getMockRequestParameterMap().put("service", service);
+        externalContext.getMockRequestParameterMap().put("gateway", "true");
         overrideEndStateOutput(FLOW_ID, "RedirectToService");
         request.setCookies(new Cookie("shib_idp_session", existing.getId()));
         initializeThreadLocals();