[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fd4f64ec4513414df10384c1f56cee72014abb81

The following commit(s) were added to refs/heads/master by this push:
       new  fd4f64e   IDP-1494 - Login flow for proxied SAML authentication
fd4f64e is described below

commit fd4f64ec4513414df10384c1f56cee72014abb81
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Nov 27 10:15:45 2019 -0500

    IDP-1494 - Login flow for proxied SAML authentication
    
    https://issues.shibboleth.net/jira/browse/IDP-1494
    
    Remove unneeded property for honoring proxy restrictions.
    Honor per-flow proxy restriction flag in Finalize step.
---
 .../net/shibboleth/idp/authn/impl/FinalizeAuthentication.java | 11 ++++++++---
 .../src/main/resources/system/conf/general-authn-system.xml   |  1 -
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
index 7c456d7..93bea52 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
@@ -100,7 +100,7 @@ public class FinalizeAuthentication extends AbstractAuthenticationAction {
     /** The principal name extracted from the context tree. */
     @Nullable private String canonicalPrincipalName;
     
-    // Checkstyle: CyclomaticComplexity OFF
+    // Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -132,7 +132,12 @@ public class FinalizeAuthentication extends AbstractAuthenticationAction {
             log.warn("{} Authentication result missing from context?", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
             return false;
-        } else if (!checkProxyRestrictions(profileRequestContext, latest.getSubject())) {
+        }
+        
+        final AuthenticationFlowDescriptor flowDescriptor =
+                authenticationContext.getAvailableFlows().get(latest.getAuthenticationFlowId());
+        if (flowDescriptor.isProxyRestrictionsEnforced() &&
+                !checkProxyRestrictions(profileRequestContext, latest.getSubject())) {
             return false;
         }
         
@@ -173,7 +178,7 @@ public class FinalizeAuthentication extends AbstractAuthenticationAction {
         
         return true;
     }
-// Checkstyle: CyclomaticComplexity ON
+// Checkstyle: CyclomaticComplexity|MethodLength ON
     
     /** {@inheritDoc} */
     @Override
diff --git a/idp-conf/src/main/resources/system/conf/general-authn-system.xml b/idp-conf/src/main/resources/system/conf/general-authn-system.xml
index c788b81..affb4a0 100644
--- a/idp-conf/src/main/resources/system/conf/general-authn-system.xml
+++ b/idp-conf/src/main/resources/system/conf/general-authn-system.xml
@@ -23,7 +23,6 @@
             p:passiveAuthenticationSupported="false"
             p:forcedAuthenticationSupported="false"
             p:nonBrowserSupported="true"
-            p:proxyRestrictionsEnforced="%{idp.authn.proxyRestrictionsEnforced:true}"
             p:lifetime="%{idp.authn.defaultLifetime:PT60M}"
             p:inactivityTimeout="%{idp.authn.defaultTimeout:PT30M}"
             p:principalWeightMap="#{getObject('shibboleth.AuthenticationPrincipalWeightMap')}">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.