[java-identity-provider] branch master updated: IDP-1114 - Better control over AuthenticationResult reuse

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b7a2b5f8047e6b99c5c970a4b8c53fb207fa8bbb

The following commit(s) were added to refs/heads/master by this push:
       new  b7a2b5f   IDP-1114 - Better control over AuthenticationResult reuse
b7a2b5f is described below

commit b7a2b5f8047e6b99c5c970a4b8c53fb207fa8bbb
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Apr 12 14:56:46 2017 -0400

    IDP-1114 - Better control over AuthenticationResult reuse
    
    https://issues.shibboleth.net/jira/browse/IDP-1114
    
    Honor reuse condition for MFA subflow reuse.
---
 .../authn/impl/TransitionMultiFactorAuthentication.java   | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
index f61ebc3..f05fd1b 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
@@ -267,11 +267,16 @@ public class TransitionMultiFactorAuthentication extends AbstractAuthenticationA
         // infinite recursion is the configuration of transitions supplied by the deployer.
         final AuthenticationResult activeResult = mfaContext.getActiveResults().get(flowId);
         if (activeResult != null) {
-            log.debug("{} Reusing active result for '{}' flow", getLogPrefix(), flowId);
-            activeResult.setLastActivityInstantToNow();
-            ActionSupport.buildProceedEvent(profileRequestContext);
-            doExecute(profileRequestContext, authenticationContext);
-            return;
+            if (flow.getReuseCondition().apply(profileRequestContext)) {
+                log.debug("{} Reusing active result for '{}' flow", getLogPrefix(), flowId);
+                activeResult.setLastActivityInstantToNow();
+                ActionSupport.buildProceedEvent(profileRequestContext);
+                doExecute(profileRequestContext, authenticationContext);
+                return;
+            } else {
+                log.debug("{} Condition blocked reuse of active result for '{}' flow", getLogPrefix(), flowId);
+                mfaContext.getActiveResults().remove(flowId);
+            }
         }
      
         if (validateLoginTransitions) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.