[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeReque...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 24 21:58:32 2016
New Revision: 8538

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8538&view=rev
Log:
IDP-980 - Reuse of authentication results for SSO is overly constrained

https://issues.shibboleth.net/jira/browse/IDP-980

Relocate profile-driven RequestedPrincipalContext population
from SSO profile flows into authn subflow.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContextTest.java
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java?rev=8538&r1=8537&r2=8538&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java	Mon Oct 24 21:58:32 2016
@@ -16,6 +16,9 @@
  */
 
 package net.shibboleth.idp.authn.impl;
+
+import java.security.Principal;
+import java.util.List;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -44,6 +47,9 @@
  * with an {@link AuthenticationProfileConfiguration} containing one or more default authentication
  * methods.
  * 
+ * <p>If such a context already exists, it is left in place unless the {@link #replaceExistingContext} property
+ * is set.</p>
+ * 
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
  * @event {@link IdPEventIds#INVALID_RELYING_PARTY_CTX}
  * @event {@link IdPEventIds#INVALID_PROFILE_CONFIG}
@@ -54,6 +60,9 @@
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(InitializeRequestedPrincipalContext.class);
 
+    /** Whether to replace an existing subcontext, if any. */
+    private boolean replaceExistingContext;
+    
     /**
      * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
      */
@@ -65,6 +74,20 @@
     /** Constructor. */
     public InitializeRequestedPrincipalContext() {
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+    }
+    
+    /**
+     * Whether any existing {@link RequestedPrincipalContext} should be replaced, defaults to "false".
+     * 
+     * <p>Normally an existing context would indicate requirements that shouldn't be circumvented to comply with
+     * expected profile behavior.</p>
+     * 
+     * @param flag flag to set
+     */
+    public void setReplaceExistingContext(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        replaceExistingContext = flag;
     }
     
     /**
@@ -86,6 +109,15 @@
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext) {
+        
+        if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
+            return false;
+        } else if (authenticationContext.getSubcontext(RequestedPrincipalContext.class) != null
+                && !replaceExistingContext) {
+            log.debug("{} Leaving existing RequestedPrincipalContext in place", getLogPrefix());
+            return false;
+        }
+        
         final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
         if (rpCtx == null) {
             log.debug("{} No relying party context", getLogPrefix());
@@ -107,12 +139,7 @@
         }
         
         authenticationProfileConfig = (AuthenticationProfileConfiguration) config;
-        if (authenticationProfileConfig.getDefaultAuthenticationMethods().isEmpty()) {
-            log.debug("{} Profile configuration does not include any default authentication methods", getLogPrefix());
-            return false;
-        }
-        
-        return super.doPreExecute(profileRequestContext, authenticationContext);
+        return true;
     }
     
     /** {@inheritDoc} */
@@ -120,12 +147,20 @@
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext) {
 
+        final List<Principal> principals = authenticationProfileConfig.getDefaultAuthenticationMethods();

[... 197 lines stripped ...]