[java-identity-provider COMMIT] in /trunk/idp-authn-impl/src: main/java/net/shibboleth/idp/authn/impl/PopulateMultiFa...

[noreply at shibboleth.net]

Author: scantor
Date: Mon May 23 21:58:10 2016
New Revision: 8251

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8251&view=rev
Log:
IDP-962 - Login flow or framework for combining authentication factors

Functionally complete orchestrator plus unit test.

Added:
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/BaseMultiFactorAuthenticationContextTest.java   (with props)
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthenticationTest.java   (with props)
Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContextTest.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java?rev=8251&r1=8250&r2=8251&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	Mon May 23 21:58:10 2016
@@ -49,8 +49,9 @@
 
 /**
  * An action that creates and populates a {@link MultiFactorAuthenticationContext} with the set of
- * transition rules to use for coordinating activity, and with any active "factors" found,
- * if an active result from the MFA flow is present in the {@link AuthenticationContext}.
+ * transition rules to use for coordinating activity, the executing {@link AuthenticationFlowDescriptor}
+ * and with any active "factors" found, if an active result from the MFA flow is present in the
+ * {@link AuthenticationContext}.
  * 
  * @event {@link EventIds#PROCEED_EVENT_ID}
  * @event {@link EventIds#INVALID_PROFILE_CTX}
@@ -133,6 +134,7 @@
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
         }
         
+        mfaCtx.setAuthenticationFlowDescriptor(authenticationContext.getAttemptedFlow());
         mfaCtx.setTransitionMap(transitionMap);
         
         if (activeResultLookupStrategy != null) {
@@ -165,6 +167,11 @@
                 if (ac != null && ac.getAttemptedFlow() != null) {
                     final AuthenticationResult mfaResult = ac.getActiveResults().get(ac.getAttemptedFlow().getId());
                     if (mfaResult != null) {
+                        if (ac.isForceAuthn()) {
+                            log.debug("{} Ignoring active result due to forced authentication requirement",
+                                    getLogPrefix());
+                            return null;
+                        }
                         final Set<AuthenticationResultPrincipal> resultPrincipals =
                                 mfaResult.getSubject().getPrincipals(AuthenticationResultPrincipal.class);
                         if (!resultPrincipals.isEmpty()) {

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java?rev=8251&r1=8250&r2=8251&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	Mon May 23 21:58:10 2016
@@ -55,22 +55,26 @@
  * <p>The execution of this function is driven by the {@link MultiFactorAuthenticationTransition}
  * rule associated with the flow that was most recently executed by this engine. If none (such as
  * during the first iteration), then the rule associated with a null value is used. Failure to locate
- * a transition to use is fatal, resulting in a {@link AuthnEventIds#NO_PASSIVE} or
- * {@link AuthnEventIds#NO_POTENTIAL_FLOW} event.</p>
+ * a transition to use is fatal, resulting in {@link AuthnEventIds#NO_PASSIVE} or
+ * {@link AuthnEventIds#NO_POTENTIAL_FLOW}.</p>
  * 
  * <p>If the transition signals completion, then the associated merging function is used to
  * produce a final {@link AuthenticationResult} and the context tree is mutated to store off
  * the result and prepare for subject canonicalization, in the fashion of most validation
  * actions. The {@link MultiFactorAutenticationContext}'s next flow is cleared and
- * {@link EventIds#PROCEED_EVENT_ID}is signaled.</p>
+ * {@link EventIds#PROCEED_EVENT_ID} is signaled.</p>
  * 

[... 146 lines stripped ...]