[java-identity-provider] branch master updated: IDP-1277 - Maximum Authentication Age

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b91f3c0baa29793d2d7fab44b3ccb21565cc37e3

The following commit(s) were added to refs/heads/master by this push:
       new  b91f3c0   IDP-1277 - Maximum Authentication Age
b91f3c0 is described below

commit b91f3c0baa29793d2d7fab44b3ccb21565cc37e3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Aug 29 11:04:57 2018 -0400

    IDP-1277 - Maximum Authentication Age
    
    https://issues.shibboleth.net/jira/browse/IDP-1277
    
    Missed a ForceAuthn check.
---
 .../shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
index 87da224..aceb31e 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
@@ -285,7 +285,8 @@ public class TransitionMultiFactorAuthentication extends AbstractAuthenticationA
                         getLogPrefix(), flowId);
                 ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_PASSIVE);
                 return;
-            } else if (authenticationContext.isForceAuthn() && !flow.isForcedAuthenticationSupported()) {
+            } else if ((authenticationContext.isForceAuthn() || authenticationContext.getMaxAge() > 0)
+                    && !flow.isForcedAuthenticationSupported()) {
                 log.error("{} Targeted login flow '{}' does not support forced re-authentication",
                         getLogPrefix(), flowId);
                 ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.REQUEST_UNSUPPORTED);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.