[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources/system/flows/authn: external-authn-flow.xml ipa...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Mar 22 11:57:53 2016
New Revision: 8172

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8172&view=rev
Log:
IDP-958 - Allow authn subflows to perform their own c14n.

https://issues.shibboleth.net/jira/browse/IDP-958

Move c14n call back into login flows.

Modified:
    trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/ipaddress-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/remoteuser-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/remoteuser-internal-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/spnego-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/x509-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/x509-internal-authn-flow.xml

Modified: trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml?rev=8172&r1=8171&r2=8172&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml	Tue Mar 22 11:57:53 2016
@@ -24,8 +24,17 @@
         <evaluate expression="ValidateExternalAuthentication" />
         <evaluate expression="'proceed'" />
 
+        <transition on="proceed" to="CallSubjectCanonicalization" />
+    </action-state>
+
+    <!-- This runs a c14n step on the result of the authentication. -->
+    <subflow-state id="CallSubjectCanonicalization" subflow="c14n/authn">
+        <input name="calledAsSubflow" value="true" />
         <transition on="proceed" to="proceed" />
-    </action-state>
+        
+        <!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. -->
+        <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+    </subflow-state>
 
     <bean-import resource="external-authn-beans.xml" />
 

Modified: trunk/idp-conf/src/main/resources/system/flows/authn/ipaddress-authn-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/authn/ipaddress-authn-flow.xml?rev=8172&r1=8171&r2=8172&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/authn/ipaddress-authn-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/authn/ipaddress-authn-flow.xml	Tue Mar 22 11:57:53 2016
@@ -10,8 +10,17 @@
         <evaluate expression="ValidateUserAgentAddress" />
         <evaluate expression="'proceed'" />
         
+        <transition on="proceed" to="CallSubjectCanonicalization" />
+    </action-state>
+
+    <!-- This runs a c14n step on the result of the authentication. -->
+    <subflow-state id="CallSubjectCanonicalization" subflow="c14n/authn">
+        <input name="calledAsSubflow" value="true" />
         <transition on="proceed" to="proceed" />
-    </action-state>
+        
+        <!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. -->
+        <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+    </subflow-state>
 
     <!-- As a "fall-through" method, remap selected events to select a different flow. -->
     <global-transitions>

Modified: trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-flow.xml?rev=8172&r1=8171&r2=8172&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-flow.xml	Tue Mar 22 11:57:53 2016
@@ -91,7 +91,7 @@
         <evaluate expression="ValidateUsernamePassword" />
         <evaluate expression="'proceed'" />
 
-        <transition on="proceed" to="proceed" />
+        <transition on="proceed" to="CallSubjectCanonicalization" />
         
         <!-- Fall through to a different flow if login fails on a passive or non-browser request. -->
         <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
@@ -99,6 +99,15 @@
         <!-- Other event transitions are determined by deployer in /flows/authn/conditions/conditions-flow.xml -->
     </action-state>
 
+    <!-- This runs a c14n step on the result of the authentication. -->
+    <subflow-state id="CallSubjectCanonicalization" subflow="c14n/authn">

[... 142 lines stripped ...]