[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources/system/flows/authn: authn-flow.xml initial-auth...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Mar 21 22:41:32 2016
New Revision: 8170

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8170&view=rev
Log:
IDP-958 - Allow authn subflows to perform their own c14n.

https://issues.shibboleth.net/jira/browse/IDP-958

Alter authn and initial-authn flows to bypass c14n if already done.

Modified:
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/initial-authn-flow.xml

Modified: trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml?rev=8170&r1=8169&r2=8170&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml	Mon Mar 21 22:41:32 2016
@@ -69,11 +69,18 @@
     -->
     <subflow-state id="CallAuthenticationFlow" subflow="#{currentEvent.id}">
         <input name="calledAsSubflow" value="true" />
-        <transition on="proceed" to="CallSubjectCanonicalization" />
+        <transition on="proceed" to="CheckSubjectCanonicalization" />
         <transition on="ReselectFlow" to="SelectAuthenticationFlow" />
     </subflow-state>
 
-    <!-- This runs a canonicalization step on the result of the authentication. -->
+    <!-- Checks if authentication flow already completed c14n. -->
+    <decision-state id="CheckSubjectCanonicalization">
+        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectCanonicalizationContext)).getPrincipalName() == null"
+            then="CallSubjectCanonicalization"
+            else="FinalizeAuthentication" />
+    </decision-state>
+
+    <!-- This runs a c14n step on the result of the authentication. -->
     <subflow-state id="CallSubjectCanonicalization" subflow="c14n/authn">
         <input name="calledAsSubflow" value="true" />
         <transition on="proceed" to="DetectIdentitySwitch" />

Modified: trunk/idp-conf/src/main/resources/system/flows/authn/initial-authn-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/authn/initial-authn-flow.xml?rev=8170&r1=8169&r2=8170&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/authn/initial-authn-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/authn/initial-authn-flow.xml	Mon Mar 21 22:41:32 2016
@@ -54,11 +54,18 @@
     -->
     <subflow-state id="CallAuthenticationFlow" subflow="#{currentEvent.id}">
         <input name="calledAsSubflow" value="true" />
-        <transition on="proceed" to="CallSubjectCanonicalization" />
+        <transition on="proceed" to="CheckSubjectCanonicalization" />
         <transition on="ReselectFlow" to="SelectAuthenticationFlow" />
     </subflow-state>
 
-    <!-- This runs a canonicalization step on the result of the authentication. -->
+    <!-- Checks if authentication flow already completed c14n. -->
+    <decision-state id="CheckSubjectCanonicalization">
+        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectCanonicalizationContext)).getPrincipalName() == null"
+            then="CallSubjectCanonicalization"
+            else="FinalizeAuthentication" />
+    </decision-state>
+
+    <!-- This runs a c14n step on the result of the authentication. -->
     <subflow-state id="CallSubjectCanonicalization" subflow="c14n/authn">
         <input name="calledAsSubflow" value="true" />
         <transition on="proceed" to="FinalizeAuthentication" />