[java-identity-provider] branch master updated: IDP-1323 - Return NoPassive for ToU without consent

[Tom Zeller]

This is an automated email from the git hooks/post-receive script.

tzeller pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=30a5019e1dec374ed87976f17aaa85e53ff1dcad

The following commit(s) were added to refs/heads/master by this push:
       new  30a5019   IDP-1323 - Return NoPassive for ToU without consent
30a5019 is described below

commit 30a5019e1dec374ed87976f17aaa85e53ff1dcad
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Thu Sep 27 10:53:01 2018 -0500

    IDP-1323 - Return NoPassive for ToU without consent
    
    Previous behavior was to prompt for consent, which is incorrect when
    IsPassive is true.
    
    https://issues.shibboleth.net/jira/browse/IDP-1323
---
 .../resources/system/flows/intercept/terms-of-use-flow.xml    | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/idp-conf/src/main/resources/system/flows/intercept/terms-of-use-flow.xml b/idp-conf/src/main/resources/system/flows/intercept/terms-of-use-flow.xml
index e668802..4ab4f43 100644
--- a/idp-conf/src/main/resources/system/flows/intercept/terms-of-use-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/intercept/terms-of-use-flow.xml
@@ -13,9 +13,16 @@
         <evaluate expression="ReadConsentFromStorage" />
         <evaluate expression="'proceed'" />
         
-        <transition on="proceed" to="IsConsentRequired" />
+        <transition on="proceed" to="TestForIsPassiveAndNoStorageRecords" />
     </action-state>
-    
+
+    <!-- Respond with NoPassive if IsPassive and no storage records were read. -->
+
+    <decision-state id="TestForIsPassiveAndNoStorageRecords">
+        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() and opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentContext)).getPreviousConsents().isEmpty()"
+            then="NoPassive" else="IsConsentRequired" />
+    </decision-state>
+
    <decision-state id="IsConsentRequired">
         <if test="IsConsentRequiredPredicate.apply(opensamlProfileRequestContext)" then="DisplayTermsOfUsePage" else="proceed" />
     </decision-state>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.