[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication

Scott Cantor cantor.2 at osu.edu
Wed Nov 27 15:34:30 EST 2019


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f9d6f1905bcae4634c32b1601b59d10a26138fda

The following commit(s) were added to refs/heads/master by this push:
       new  f9d6f19   IDP-1494 - Login flow for proxied SAML authentication
f9d6f19 is described below

commit f9d6f1905bcae4634c32b1601b59d10a26138fda
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Nov 27 15:34:26 2019 -0500

    IDP-1494 - Login flow for proxied SAML authentication
    
    https://issues.shibboleth.net/jira/browse/IDP-1494
    
    Cleanup support for ignoring Scoping.
    Add Scoping to outbound requests.
---
 .../system/conf/relying-party-mddriven.xml         |  8 +++
 .../system/flows/saml/saml-abstract-beans.xml      |  3 +-
 .../config/BrowserSSOProfileConfiguration.java     | 41 +++++++++++++
 .../logic/IgnoreScopingProfileConfigPredicate.java | 49 ++++++++++++++++
 .../impl/InitializeAuthenticationContext.java      | 53 ++++++++---------
 .../saml/saml2/profile/impl/AddAuthnRequest.java   | 67 +++++++++++++++++++---
 .../impl/InitializeAuthenticationContextTest.java  | 10 ++--
 7 files changed, 190 insertions(+), 41 deletions(-)

diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index eb11b1d..74049a8 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -374,6 +374,14 @@
                 <constructor-arg value="true" />
             </bean>
         </property>
+        <property name="ignoreScopingPredicate">
+            <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="ignoreScoping" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
         <property name="forceAuthnPredicate">
             <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
                 <constructor-arg>
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
index 137d1a9..5fbbdbf 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
@@ -228,8 +228,7 @@
         p:storageServices="#{ getObject('shibboleth.ClientStorageServices') ?: getObject('shibboleth.DefaultClientStorageServices') }" />
 
     <bean id="InitializeAuthenticationContext"
-        class="net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext" scope="prototype"
-        p:honorAuthnRequest="%{idp.saml.honorAuthnRequest:true}" />
+        class="net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext" scope="prototype" />
 
     <bean id="ResolveAttributes" class="net.shibboleth.idp.profile.impl.ResolveAttributes" scope="prototype"
         c:resolverService-ref="shibboleth.AttributeResolverService"
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 8d9086e..1cc9cf7 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -72,6 +72,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
     /** Whether responses to the authentication request should include an attribute statement. */
     @Nonnull private Predicate<ProfileRequestContext> includeAttributeStatementPredicate;
 
+    /** Whether to ignore Scoping elements within AuthnRequest. */
+    @Nonnull private Predicate<ProfileRequestContext> ignoreScoping;
+    
     /** Whether to mandate forced authentication for the request. */
     @Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
 
@@ -134,6 +137,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
         setEncryptAssertions(true);
         resolveAttributesPredicate = Predicates.alwaysTrue();
         includeAttributeStatementPredicate = Predicates.alwaysTrue();
+        ignoreScoping = Predicates.alwaysFalse();
         forceAuthnPredicate = new ProxyAwareForceAuthnPredicate();
         checkAddressPredicate = Predicates.alwaysTrue();
         skipEndpointValidationWhenSignedPredicate = Predicates.alwaysFalse();
@@ -214,6 +218,43 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
                 "Include attribute statement predicate cannot be null");
     }
     
+    /**
+     * Gets whether Scoping elements in requests should be ignored/omitted.
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return whether Scoping elements in requests should be ignored/omitted
+     * 
+     * @since 4.0.0
+     */
+    public boolean isIgnoreScoping(@Nullable final ProfileRequestContext profileRequestContext) {
+        return ignoreScoping.test(profileRequestContext);
+    }
+    
+    /**
+     * Sets whether Scoping elements in requests should be ignored/omitted.
+     * 
+     * <p>Defaults to false.</p>
+     * 
+     * @param flag flag to set
+     * 
+     * @since 4.0.0
+     */
+    public void setIgnoreScoping(final boolean flag) {
+        ignoreScoping = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+    
+    /**
+     * Sets a condition to determine whether Scoping elements in requests should be ignored/omitted.
+     * 
+     * @param condition condition to set
+     * 
+     * @since 4.0.0
+     */
+    public void setIgnoreScopingPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        ignoreScoping = Constraint.isNotNull(condition, "Ignore Scoping condition cannot be null");
+    }
+    
     /** {@inheritDoc} */
     public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
         return forceAuthnPredicate.test(profileRequestContext);
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreScopingProfileConfigPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreScopingProfileConfigPredicate.java
new file mode 100644
index 0000000..973b960
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreScopingProfileConfigPredicate.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A predicate that evaluates a {@link ProfileRequestContext} and extracts the effective
+ * setting of {@link BrowserSSOProfileConfiguration#isIgnoreScoping(ProfileRequestContext)}.
+ * 
+ * <p>Defaults to false.</p>
+ * 
+ * @since 4.0.0
+ */
+public class IgnoreScopingProfileConfigPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null && rpc.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
+            return ((BrowserSSOProfileConfiguration) rpc.getProfileConfig()).isIgnoreScoping(input);
+        }
+        
+        return false;
+    }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
index 44e95f4..247c6db 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
@@ -30,6 +30,7 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+import net.shibboleth.idp.saml.saml2.profile.config.logic.IgnoreScopingProfileConfigPredicate;
 import net.shibboleth.idp.saml.saml2.profile.config.navigate.ProxyCountLookupFunction;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -69,16 +70,16 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
 
     /** Extracts forceAuthn property from profile config. */
     @Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
-    
+
+    /** Extracts ignoreScoping property from profile config. */
+    @Nonnull private Predicate<ProfileRequestContext> ignoreScopingPredicate;
+
     /** Strategy used to determine proxy count from configuration. */
     @Nullable private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
     
     /** Strategy used to locate the {@link AuthnRequest} to operate on, if any. */
     @Nonnull private Function<ProfileRequestContext,AuthnRequest> requestLookupStrategy;
     
-    /** Whether to honor various policy in an {@link AuthnRequest}. */
-    private boolean honorAuthnRequest;
-    
     /** Incoming SAML 2.0 request, if present. */
     @Nullable private AuthnRequest authnRequest;
 
@@ -86,9 +87,9 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
     public InitializeAuthenticationContext() {
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
         forceAuthnPredicate = new ForceAuthnProfileConfigPredicate();
+        ignoreScopingPredicate = new IgnoreScopingProfileConfigPredicate();
         proxyCountLookupStrategy = new ProxyCountLookupFunction();
         requestLookupStrategy = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
-        honorAuthnRequest = true;
     }
     
     /**
@@ -118,7 +119,20 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
         
         forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
     }
-    
+
+    /**
+     * Set the predicate to apply to determine whether to ignore any inbound {@link Scoping} element. 
+     * 
+     * @param condition condition to set
+     * 
+     * @since 4.0.0
+     */
+    public void setIgnoreScopingPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        ignoreScopingPredicate = Constraint.isNotNull(condition, "Ignore Scoping predicate cannot be null");
+    }
+
     /**
      * Set the lookup function to apply to derive the proxy count from the configuration.
      * 
@@ -143,22 +157,6 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
         requestLookupStrategy = Constraint.isNotNull(strategy, "AuthnRequest lookup strategy cannot be null");
     }
     
-    /**
-     * Sets whether to honor various policy in an {@link AuthnRequest} such as IsPassive, ForceAuthn, and Scoping.
-     * 
-     * <p>Turning this off constitutes a standards violation and is provided for compatibility with garbage SAML
-     * implementations and incompetent deployers.</p>
-     * 
-     * @param flag flag to set
-     * 
-     * @since 4.0.0
-     */
-    public void setHonorAuthnRequest(final boolean flag) {
-        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-        
-        honorAuthnRequest = flag;
-    }
-    
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -168,12 +166,6 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
         }
         
         authnRequest = requestLookupStrategy.apply(profileRequestContext);
-        
-        if (authnRequest != null && !honorAuthnRequest) {
-            log.warn("{} Ignoring incoming AuthnRequest policy content in violation of SAML standard",
-                    getLogPrefix());
-            authnRequest = null;
-        }
         return true;
     }
     
@@ -235,6 +227,11 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
             return true;
         }
         
+        if (ignoreScopingPredicate.test(profileRequestContext)) {
+            log.warn("{} Ignoring inbound Scoping element in AuthnRequest in violation of standard", getLogPrefix());
+            return true;
+        }
+        
         // Check if permitted.
         final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
         if (rpContext != null && rpContext.getProfileConfig() != null
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
index 8593ad0..4ef0000 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
 import java.security.Principal;
 import java.time.Instant;
 import java.util.List;
+import java.util.Set;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
@@ -33,6 +34,7 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
 import net.shibboleth.idp.saml.authn.principal.AuthnContextDeclRefPrincipal;
 import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
@@ -49,9 +51,12 @@ import org.opensaml.saml.common.SAMLObjectBuilder;
 import org.opensaml.saml.common.SAMLVersion;
 import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
 import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.IDPEntry;
+import org.opensaml.saml.saml2.core.IDPList;
 import org.opensaml.saml.saml2.core.Issuer;
 import org.opensaml.saml.saml2.core.NameIDPolicy;
 import org.opensaml.saml.saml2.core.RequestedAuthnContext;
+import org.opensaml.saml.saml2.core.Scoping;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -202,6 +207,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
     }
 // Checkstyle: CyclomaticComplexity ON
 
+// Checkstyle: MethodLength OFF
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -217,9 +223,6 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
         final SAMLObjectBuilder<NameIDPolicy> nipBuilder =
                 (SAMLObjectBuilder<NameIDPolicy>) bf.<NameIDPolicy>getBuilderOrThrow(
                         NameIDPolicy.DEFAULT_ELEMENT_NAME);
-        final SAMLObjectBuilder<RequestedAuthnContext> racBuilder =
-                (SAMLObjectBuilder<RequestedAuthnContext>) bf.<RequestedAuthnContext>getBuilderOrThrow(
-                        RequestedAuthnContext.DEFAULT_ELEMENT_NAME);
 
         final AuthnRequest object = requestBuilder.buildObject();
         
@@ -263,7 +266,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
         
         object.setNameIDPolicy(nip);
 
-        final RequestedAuthnContext rac = getRequestedAuthnContext(profileRequestContext, racBuilder);
+        final RequestedAuthnContext rac = getRequestedAuthnContext(profileRequestContext);
         if (rac != null) {
             final AuthnContextComparisonTypeEnumeration operator =
                     profileConfiguration.getAuthnContextComparison(profileRequestContext);
@@ -274,20 +277,22 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
             object.setRequestedAuthnContext(rac);
         }
         
+        object.setScoping(buildScoping(profileRequestContext, authenticationContext.getProxyCount(),
+                authenticationContext.getProxiableAuthorities()));
+        
         profileRequestContext.getOutboundMessageContext().setMessage(object);
     }
+// Checkstyle: MethodLength ON
     
     /**
      * Build a {@link RequestedAuthnContext} if warranted.
      * 
      * @param profileRequestContext current profile request context
-     * @param builder object builder
      * 
      * @return the object to include in the request, or null
      */
     @Nullable private RequestedAuthnContext getRequestedAuthnContext(
-            @Nullable final ProfileRequestContext profileRequestContext,
-            @Nonnull final SAMLObjectBuilder<RequestedAuthnContext> builder) {
+            @Nullable final ProfileRequestContext profileRequestContext) {
         
         // RequestedAuthnContext also based on profile configuration.
         final List<Principal> principals = profileConfiguration.getDefaultAuthenticationMethods(profileRequestContext);
@@ -295,6 +300,11 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
             return null;
         }
         
+        final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
+        final SAMLObjectBuilder<RequestedAuthnContext> builder =
+                (SAMLObjectBuilder<RequestedAuthnContext>) bf.<RequestedAuthnContext>getBuilderOrThrow(
+                        RequestedAuthnContext.DEFAULT_ELEMENT_NAME);
+        
         // Check for class refs.
         final List<AuthnContextClassRefPrincipal> classRefPrincipals = principals.stream()
                 .filter(AuthnContextClassRefPrincipal.class::isInstance)
@@ -344,4 +354,47 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
         return null;
     }
     
+    /**
+     * Build a {@Scoping} element, decrementing the proxy count if set.
+     * 
+     * @param profileRequestContext current profile request context
+     * @param count proxy count
+     * @param idplist list of IdP entityIDs
+     * 
+     * @return populated {@link Scoping}
+     */
+    @Nullable public Scoping buildScoping(@Nonnull final ProfileRequestContext profileRequestContext,
+            @Nullable final Integer count, @Nonnull @NonnullElements final Set<String> idplist) {
+        
+        if (count == null && idplist.isEmpty()) {
+            return null;
+        } else if (profileConfiguration.isIgnoreScoping(profileRequestContext)) {
+            log.warn("{} Skipping generation of Scoping element in violation of standard", getLogPrefix());
+            return null;
+        }
+        
+        final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
+        final SAMLObjectBuilder<Scoping> scopingBuilder =
+                (SAMLObjectBuilder<Scoping>) bf.<Scoping>getBuilderOrThrow(Scoping.DEFAULT_ELEMENT_NAME);
+        final Scoping scoping = scopingBuilder.buildObject();
+        scoping.setProxyCount(Integer.min(0, count - 1));
+        
+        if (!idplist.isEmpty()) {
+            final SAMLObjectBuilder<IDPList> idpListBuilder =
+                    (SAMLObjectBuilder<IDPList>) bf.<IDPList>getBuilderOrThrow(IDPList.DEFAULT_ELEMENT_NAME);
+            final SAMLObjectBuilder<IDPEntry> idpBuilder =
+                    (SAMLObjectBuilder<IDPEntry>) bf.<IDPEntry>getBuilderOrThrow(IDPEntry.DEFAULT_ELEMENT_NAME);
+                        
+            final IDPList idps = idpListBuilder.buildObject();
+            for (final String idp : idplist) {
+                final IDPEntry entry = idpBuilder.buildObject();
+                entry.setProviderID(idp);
+                idps.getIDPEntrys().add(entry);
+            }
+            scoping.setIDPList(idps);
+        }
+        
+        return scoping;
+    }
+    
 }
\ No newline at end of file
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
index 9388220..1695b72 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
@@ -40,6 +40,8 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import com.google.common.base.Predicates;
+
 /** {@link InitializeAuthenticationContext} unit test. */
 public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCase {
 
@@ -122,7 +124,7 @@ public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCas
         Assert.assertEquals(authnCtx.getProxyCount(), Integer.valueOf(1));
     }
 
-    @Test public void testAuthnRequestIgnored() throws ComponentInitializationException {
+    @Test public void testScopingIgnored() throws ComponentInitializationException {
         final AuthnRequest authnRequest = SAML2ActionTestingSupport.buildAuthnRequest();
         authnRequest.setIsPassive(true);
         authnRequest.setForceAuthn(true);
@@ -136,7 +138,7 @@ public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCas
 
         action = new InitializeAuthenticationContext();
         action.setProxyCountLookupStrategy(FunctionSupport.constant(1));
-        action.setHonorAuthnRequest(false);
+        action.setIgnoreScopingPredicate(Predicates.alwaysTrue());
         action.initialize();
         
         final Event event = action.execute(requestCtx);
@@ -144,8 +146,8 @@ public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCas
         
         final AuthenticationContext authnCtx = prc.getSubcontext(AuthenticationContext.class);
         Assert.assertNotNull(authnCtx);
-        Assert.assertFalse(authnCtx.isForceAuthn());
-        Assert.assertFalse(authnCtx.isPassive());
+        Assert.assertTrue(authnCtx.isForceAuthn());
+        Assert.assertTrue(authnCtx.isPassive());
         Assert.assertEquals(authnCtx.getProxyCount(), Integer.valueOf(1));
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list