[java-identity-provider] branch master updated: IDP-1323 - Return NoPassive for attribute query without consent

[Tom Zeller]

This is an automated email from the git hooks/post-receive script.

tzeller pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0f7251372a8ecf3ca5eb83009d32c7f3009ab097

The following commit(s) were added to refs/heads/master by this push:
       new  0f72513   IDP-1323 - Return NoPassive for attribute query without consent
0f72513 is described below

commit 0f7251372a8ecf3ca5eb83009d32c7f3009ab097
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Thu Sep 20 14:00:24 2018 -0500

    IDP-1323 - Return NoPassive for attribute query without consent
    
    Previous behavior was to prompt for consent, which is incorrect when
    IsPassive is true.
    
    https://issues.shibboleth.net/jira/browse/IDP-1323
---
 .../system/flows/intercept/attribute-release-flow.xml          | 10 +++++++++-
 .../system/flows/intercept/intercept-abstract-flow.xml         |  2 ++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/idp-conf/src/main/resources/system/flows/intercept/attribute-release-flow.xml b/idp-conf/src/main/resources/system/flows/intercept/attribute-release-flow.xml
index 800c26b..712a502 100644
--- a/idp-conf/src/main/resources/system/flows/intercept/attribute-release-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/intercept/attribute-release-flow.xml
@@ -79,10 +79,18 @@
         <evaluate expression="ReadGlobalAttributeConsentFromStorage" />
         <evaluate expression="'proceed'" />
         
-        <transition on="proceed" to="TestForGlobalAttributeConsent" />
+        <transition on="proceed" to="TestForIsPassiveAndNoStorageRecords" />
     </action-state>
 
 
+    <!-- Respond with NoPassive if IsPassive and no storage records were read. -->
+
+    <decision-state id="TestForIsPassiveAndNoStorageRecords">
+        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() and opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentContext)).getPreviousConsents().isEmpty()"
+            then="NoPassive" else="TestForGlobalAttributeConsent" />
+    </decision-state>
+
+
     <!-- If global consent has been given by user, skip the rest of the flow. -->
     
     <decision-state id="TestForGlobalAttributeConsent">
diff --git a/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml b/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml
index eef4a1f..d082010 100644
--- a/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml
@@ -23,6 +23,7 @@
     <end-state id="ImpersonationViolation" />
     <end-state id="RestartAuthentication" />
     <end-state id="RuntimeException" />
+    <end-state id="NoPassive" />
 
     <action-state id="LogRuntimeException">
         <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile.interceptor').error('Uncaught runtime exception', flowExecutionException.getCause() ?: flowExecutionException)" />
@@ -41,6 +42,7 @@
         <transition on="ImpersonationViolation" to="ImpersonationViolation" />
         <transition on="RestartAuthentication" to="RestartAuthentication" />
         <transition on="RuntimeException" to="RuntimeException" />
+        <transition on="NoPassive" to="NoPassive" />
     </global-transitions>
 
 </flow>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.