[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactor...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Sep 30 21:56:30 2016
New Revision: 8440

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8440&view=rev
Log:
IDP-962 - Login flow or framework for combining authentication factors

https://issues.shibboleth.net/jira/browse/IDP-962

Leverage login flow activation condition to control reuse of results.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java?rev=8440&r1=8439&r2=8440&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java	Fri Sep 30 21:56:30 2016
@@ -202,7 +202,7 @@
                                 // a small number of edge cases.
                                 resultPrincipal.getAuthenticationResult().setLastActivityInstant(
                                         mfaResult.getLastActivityInstant());
-                                processActiveResult(ac, results, resultPrincipal.getAuthenticationResult());
+                                processActiveResult(input, ac, results, resultPrincipal.getAuthenticationResult());
                             }
                             
                             return results;
@@ -217,21 +217,28 @@
         /**
          * Check an active result for possible inclusion in the returned collection.
          * 
+         * @param profileRequestContext current profile request context
          * @param authenticationContext current authentication context
          * @param results the collection to add to
          * @param candidate the result to evaluate
          */
-        void processActiveResult(@Nonnull final AuthenticationContext authenticationContext,
+        void processActiveResult(@Nonnull final ProfileRequestContext profileRequestContext,
+                @Nonnull final AuthenticationContext authenticationContext,
                 @Nonnull final Collection<AuthenticationResult> results,
                 @Nonnull final AuthenticationResult candidate) {
             
             final AuthenticationFlowDescriptor descriptor = authenticationContext.getAvailableFlows().get(
                     candidate.getAuthenticationFlowId());
             if (descriptor != null) {
-                if (descriptor.isResultActive(candidate)) {
-                    results.add(candidate);
+                if (descriptor.apply(profileRequestContext)) {
+                    if (descriptor.isResultActive(candidate)) {
+                        results.add(candidate);
+                    } else {
+                        log.debug("{} Result from login flow {} has expired", getLogPrefix(), descriptor.getId());
+                    }
                 } else {
-                    log.debug("{} Result from login flow {} has expired", getLogPrefix(), descriptor.getId());
+                    log.debug("{} Ignoring active result from login flow {} due to activation condition",
+                            getLogPrefix(), candidate.getAuthenticationFlowId());
                 }
             } else {
                 log.warn("{} Ignoring active result from undefined login flow {}", getLogPrefix(),