[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFa...

[noreply at shibboleth.net]

Author: scantor
Date: Wed May 25 14:55:16 2016
New Revision: 8256

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8256&view=rev
Log:
IDP-962 - Login flow or framework for combining authentication factors

First mostly-working version of the MFA controller flow.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
    trunk/idp-conf/src/main/resources/conf/authn/general-authn.xml
    trunk/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml
    trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/mfa-authn-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/mfa-authn-flow.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java?rev=8256&r1=8255&r2=8256&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	Wed May 25 14:55:16 2016
@@ -136,6 +136,8 @@
         
         mfaCtx.setAuthenticationFlowDescriptor(authenticationContext.getAttemptedFlow());
         mfaCtx.setTransitionMap(transitionMap);
+        mfaCtx.setNextFlowId(null);
+        mfaCtx.getActiveResults().clear();
         
         if (activeResultLookupStrategy != null) {
             final Collection<AuthenticationResult> results = activeResultLookupStrategy.apply(profileRequestContext);

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java?rev=8256&r1=8255&r2=8256&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java	Wed May 25 14:55:16 2016
@@ -21,12 +21,15 @@
 import javax.annotation.Nullable;
 
 import net.shibboleth.idp.authn.AbstractAuthenticationAction;
+import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
 import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.MultiFactorAuthenticationTransition;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
+import net.shibboleth.idp.profile.context.navigate.RelyingPartyIdLookupFunction;
+import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
 import net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -72,9 +75,11 @@
  * 
  * <p>If a flow is returned, it is populated into the {@link MultiFactorAutenticationContext}.
  * The flow is checked for the "authn/" prefix, and a login flow is checked against the
- * active result map to determine if it can be reused, in which case
- * {@link AuthnEventIds#RESELECT_FLOW} is signaled to recurse the process. Otherwise
- * {@link EventIds#PROCEED_EVENT_ID}is signaled to run the flow.</p>
+ * active result map to determine if it can be reused, in which case the action recurses itself.
+ * Otherwise {@link EventIds#PROCEED_EVENT_ID}is signaled to run the flow.</p>
+ * 
+ * <p>By default, login flow transitions are validated against the request's requirements
+ * in terms of passive, forced re-authn, and non-browser compatibility.</p>
  * 
  * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class).getSubcontext(
  *      MultiFactorAuthenticationContext.class) != null</pre>
@@ -83,8 +88,9 @@
  * @event {@link EventIds#INVALID_PROFILE_CTX}
  * @event {@link AuthnEventIds#NO_PASSIVE}
  * @event {@link AuthnEventIds#NO_POTENTIAL_FLOW}
- * @event {@link AuthnEventIds#RESELECT_FLOW}
  * @event {@link AuthnEventIds#INVALID_CREDENTIALS}
+ * @event {@link AuthnEventIds#REQUEST_UNSUPPORTED}
+ * @event (any event signaled by another called flow)
  */
 public class TransitionMultiFactorAuthentication extends AbstractAuthenticationAction {
 
@@ -106,6 +112,9 @@
 
     /** Function used to obtain the responder ID. */

[... 314 lines stripped ...]