[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthentic...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 24 23:34:37 2016
New Revision: 8539

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8539&view=rev
Log:
IDP-980 - Reuse of authentication results for SSO is overly constrained

https://issues.shibboleth.net/jira/browse/IDP-980

Roll back most of the earlier changes for compatibility.
Fix IsPassive issue by removing passivity flow filtering and replacing
with inline passive support checks when selecting inactive flows.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/BaseAuthenticationContextTest.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlowTest.java
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/initial-authn-flow.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java?rev=8539&r1=8538&r2=8539&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java	Mon Oct 24 23:34:37 2016
@@ -160,7 +160,7 @@
             @Nonnull final AuthenticationContext authenticationContext) {
         
         // See if flow exists.
-        final AuthenticationFlowDescriptor flow = authenticationContext.getAvailableFlows().get(
+        final AuthenticationFlowDescriptor flow = authenticationContext.getPotentialFlows().get(
                 authenticationContext.getSignaledFlowId());
         if (flow == null) {
             log.error("{} Signaled flow {} is not available", getLogPrefix(),
@@ -212,7 +212,12 @@
         
         // Try and use the inactive flow.
 
-        if (requestedPrincipalCtx != null) {
+        // Check for IsPassive compatibility.
+        if (authenticationContext.isPassive() && !flow.isPassiveAuthenticationSupported()) {
+            log.error("{} Signaled flow {} does not support passive authentication", getLogPrefix(), flow.getId());
+            ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_PASSIVE);
+            return;
+        } else if (requestedPrincipalCtx != null) {
             for (final Principal p : requestedPrincipalCtx.getRequestedPrincipals()) {
                 final PrincipalEvalPredicate predicate = requestedPrincipalCtx.getPredicate(p);
                 if (predicate != null) {
@@ -250,7 +255,9 @@
         log.debug("{} No specific Principals requested", getLogPrefix());
         
         // Check for initial authentication (valid even in presence of forced authentication).
-        if (authenticationContext.getInitialAuthenticationResult() != null) {
+        if (authenticationContext.getInitialAuthenticationResult() != null
+                && authenticationContext.getPotentialFlows().containsKey(
+                        authenticationContext.getInitialAuthenticationResult().getAuthenticationFlowId())) {
             selectActiveResult(profileRequestContext, authenticationContext,
                     authenticationContext.getInitialAuthenticationResult());
             return;
@@ -271,10 +278,13 @@
         }
 
         // Pick a result to reuse if possible.
-        if (!authenticationContext.getActiveResults().isEmpty()) {
-            selectActiveResult(profileRequestContext, authenticationContext,
-                    authenticationContext.getActiveResults().values().iterator().next());
-            return;
+        for (final AuthenticationResult activeResult : authenticationContext.getActiveResults().values()) {
+            final AuthenticationFlowDescriptor flow = authenticationContext.getPotentialFlows().get(
+                    activeResult.getAuthenticationFlowId());
+            if (flow != null) {
+                selectActiveResult(profileRequestContext, authenticationContext, activeResult);
+                return;
+            }
         }
         
         log.debug("{} No usable active results available, selecting an inactive flow", getLogPrefix());
@@ -303,8 +313,10 @@
             @Nonnull final AuthenticationContext authenticationContext) {
         for (final AuthenticationFlowDescriptor flow : authenticationContext.getPotentialFlows().values()) {
             if (!authenticationContext.getIntermediateFlows().containsKey(flow.getId())) {
-                if (flow.apply(profileRequestContext)) {
-                    return flow;
+                if (!authenticationContext.isPassive() || flow.isPassiveAuthenticationSupported()) {
+                    if (flow.apply(profileRequestContext)) {
+                        return flow;

[... 118 lines stripped ...]