[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication
Scott Cantor
cantor.2 at osu.edu
Wed Nov 27 15:34:30 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f9d6f1905bcae4634c32b1601b59d10a26138fda
The following commit(s) were added to refs/heads/master by this push:
new f9d6f19 IDP-1494 - Login flow for proxied SAML authentication
f9d6f19 is described below
commit f9d6f1905bcae4634c32b1601b59d10a26138fda
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Nov 27 15:34:26 2019 -0500
IDP-1494 - Login flow for proxied SAML authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Cleanup support for ignoring Scoping.
Add Scoping to outbound requests.
---
.../system/conf/relying-party-mddriven.xml | 8 +++
.../system/flows/saml/saml-abstract-beans.xml | 3 +-
.../config/BrowserSSOProfileConfiguration.java | 41 +++++++++++++
.../logic/IgnoreScopingProfileConfigPredicate.java | 49 ++++++++++++++++
.../impl/InitializeAuthenticationContext.java | 53 ++++++++---------
.../saml/saml2/profile/impl/AddAuthnRequest.java | 67 +++++++++++++++++++---
.../impl/InitializeAuthenticationContextTest.java | 10 ++--
7 files changed, 190 insertions(+), 41 deletions(-)
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index eb11b1d..74049a8 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -374,6 +374,14 @@
<constructor-arg value="true" />
</bean>
</property>
+ <property name="ignoreScopingPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="ignoreScoping" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
<property name="forceAuthnPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
index 137d1a9..5fbbdbf 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
@@ -228,8 +228,7 @@
p:storageServices="#{ getObject('shibboleth.ClientStorageServices') ?: getObject('shibboleth.DefaultClientStorageServices') }" />
<bean id="InitializeAuthenticationContext"
- class="net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext" scope="prototype"
- p:honorAuthnRequest="%{idp.saml.honorAuthnRequest:true}" />
+ class="net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext" scope="prototype" />
<bean id="ResolveAttributes" class="net.shibboleth.idp.profile.impl.ResolveAttributes" scope="prototype"
c:resolverService-ref="shibboleth.AttributeResolverService"
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 8d9086e..1cc9cf7 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -72,6 +72,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
/** Whether responses to the authentication request should include an attribute statement. */
@Nonnull private Predicate<ProfileRequestContext> includeAttributeStatementPredicate;
+ /** Whether to ignore Scoping elements within AuthnRequest. */
+ @Nonnull private Predicate<ProfileRequestContext> ignoreScoping;
+
/** Whether to mandate forced authentication for the request. */
@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
@@ -134,6 +137,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
setEncryptAssertions(true);
resolveAttributesPredicate = Predicates.alwaysTrue();
includeAttributeStatementPredicate = Predicates.alwaysTrue();
+ ignoreScoping = Predicates.alwaysFalse();
forceAuthnPredicate = new ProxyAwareForceAuthnPredicate();
checkAddressPredicate = Predicates.alwaysTrue();
skipEndpointValidationWhenSignedPredicate = Predicates.alwaysFalse();
@@ -214,6 +218,43 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
"Include attribute statement predicate cannot be null");
}
+ /**
+ * Gets whether Scoping elements in requests should be ignored/omitted.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether Scoping elements in requests should be ignored/omitted
+ *
+ * @since 4.0.0
+ */
+ public boolean isIgnoreScoping(@Nullable final ProfileRequestContext profileRequestContext) {
+ return ignoreScoping.test(profileRequestContext);
+ }
+
+ /**
+ * Sets whether Scoping elements in requests should be ignored/omitted.
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.0.0
+ */
+ public void setIgnoreScoping(final boolean flag) {
+ ignoreScoping = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Sets a condition to determine whether Scoping elements in requests should be ignored/omitted.
+ *
+ * @param condition condition to set
+ *
+ * @since 4.0.0
+ */
+ public void setIgnoreScopingPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ ignoreScoping = Constraint.isNotNull(condition, "Ignore Scoping condition cannot be null");
+ }
+
/** {@inheritDoc} */
public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
return forceAuthnPredicate.test(profileRequestContext);
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreScopingProfileConfigPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreScopingProfileConfigPredicate.java
new file mode 100644
index 0000000..973b960
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreScopingProfileConfigPredicate.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A predicate that evaluates a {@link ProfileRequestContext} and extracts the effective
+ * setting of {@link BrowserSSOProfileConfiguration#isIgnoreScoping(ProfileRequestContext)}.
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @since 4.0.0
+ */
+public class IgnoreScopingProfileConfigPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null && rpc.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
+ return ((BrowserSSOProfileConfiguration) rpc.getProfileConfig()).isIgnoreScoping(input);
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
index 44e95f4..247c6db 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
@@ -30,6 +30,7 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+import net.shibboleth.idp.saml.saml2.profile.config.logic.IgnoreScopingProfileConfigPredicate;
import net.shibboleth.idp.saml.saml2.profile.config.navigate.ProxyCountLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -69,16 +70,16 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
/** Extracts forceAuthn property from profile config. */
@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
-
+
+ /** Extracts ignoreScoping property from profile config. */
+ @Nonnull private Predicate<ProfileRequestContext> ignoreScopingPredicate;
+
/** Strategy used to determine proxy count from configuration. */
@Nullable private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
/** Strategy used to locate the {@link AuthnRequest} to operate on, if any. */
@Nonnull private Function<ProfileRequestContext,AuthnRequest> requestLookupStrategy;
- /** Whether to honor various policy in an {@link AuthnRequest}. */
- private boolean honorAuthnRequest;
-
/** Incoming SAML 2.0 request, if present. */
@Nullable private AuthnRequest authnRequest;
@@ -86,9 +87,9 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
public InitializeAuthenticationContext() {
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
forceAuthnPredicate = new ForceAuthnProfileConfigPredicate();
+ ignoreScopingPredicate = new IgnoreScopingProfileConfigPredicate();
proxyCountLookupStrategy = new ProxyCountLookupFunction();
requestLookupStrategy = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
- honorAuthnRequest = true;
}
/**
@@ -118,7 +119,20 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
}
-
+
+ /**
+ * Set the predicate to apply to determine whether to ignore any inbound {@link Scoping} element.
+ *
+ * @param condition condition to set
+ *
+ * @since 4.0.0
+ */
+ public void setIgnoreScopingPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ ignoreScopingPredicate = Constraint.isNotNull(condition, "Ignore Scoping predicate cannot be null");
+ }
+
/**
* Set the lookup function to apply to derive the proxy count from the configuration.
*
@@ -143,22 +157,6 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
requestLookupStrategy = Constraint.isNotNull(strategy, "AuthnRequest lookup strategy cannot be null");
}
- /**
- * Sets whether to honor various policy in an {@link AuthnRequest} such as IsPassive, ForceAuthn, and Scoping.
- *
- * <p>Turning this off constitutes a standards violation and is provided for compatibility with garbage SAML
- * implementations and incompetent deployers.</p>
- *
- * @param flag flag to set
- *
- * @since 4.0.0
- */
- public void setHonorAuthnRequest(final boolean flag) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- honorAuthnRequest = flag;
- }
-
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -168,12 +166,6 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
}
authnRequest = requestLookupStrategy.apply(profileRequestContext);
-
- if (authnRequest != null && !honorAuthnRequest) {
- log.warn("{} Ignoring incoming AuthnRequest policy content in violation of SAML standard",
- getLogPrefix());
- authnRequest = null;
- }
return true;
}
@@ -235,6 +227,11 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
return true;
}
+ if (ignoreScopingPredicate.test(profileRequestContext)) {
+ log.warn("{} Ignoring inbound Scoping element in AuthnRequest in violation of standard", getLogPrefix());
+ return true;
+ }
+
// Check if permitted.
final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (rpContext != null && rpContext.getProfileConfig() != null
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
index 8593ad0..4ef0000 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
import java.security.Principal;
import java.time.Instant;
import java.util.List;
+import java.util.Set;
import java.util.function.Function;
import java.util.stream.Collectors;
@@ -33,6 +34,7 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
import net.shibboleth.idp.saml.authn.principal.AuthnContextDeclRefPrincipal;
import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
@@ -49,9 +51,12 @@ import org.opensaml.saml.common.SAMLObjectBuilder;
import org.opensaml.saml.common.SAMLVersion;
import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.IDPEntry;
+import org.opensaml.saml.saml2.core.IDPList;
import org.opensaml.saml.saml2.core.Issuer;
import org.opensaml.saml.saml2.core.NameIDPolicy;
import org.opensaml.saml.saml2.core.RequestedAuthnContext;
+import org.opensaml.saml.saml2.core.Scoping;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -202,6 +207,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
}
// Checkstyle: CyclomaticComplexity ON
+// Checkstyle: MethodLength OFF
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -217,9 +223,6 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
final SAMLObjectBuilder<NameIDPolicy> nipBuilder =
(SAMLObjectBuilder<NameIDPolicy>) bf.<NameIDPolicy>getBuilderOrThrow(
NameIDPolicy.DEFAULT_ELEMENT_NAME);
- final SAMLObjectBuilder<RequestedAuthnContext> racBuilder =
- (SAMLObjectBuilder<RequestedAuthnContext>) bf.<RequestedAuthnContext>getBuilderOrThrow(
- RequestedAuthnContext.DEFAULT_ELEMENT_NAME);
final AuthnRequest object = requestBuilder.buildObject();
@@ -263,7 +266,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
object.setNameIDPolicy(nip);
- final RequestedAuthnContext rac = getRequestedAuthnContext(profileRequestContext, racBuilder);
+ final RequestedAuthnContext rac = getRequestedAuthnContext(profileRequestContext);
if (rac != null) {
final AuthnContextComparisonTypeEnumeration operator =
profileConfiguration.getAuthnContextComparison(profileRequestContext);
@@ -274,20 +277,22 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
object.setRequestedAuthnContext(rac);
}
+ object.setScoping(buildScoping(profileRequestContext, authenticationContext.getProxyCount(),
+ authenticationContext.getProxiableAuthorities()));
+
profileRequestContext.getOutboundMessageContext().setMessage(object);
}
+// Checkstyle: MethodLength ON
/**
* Build a {@link RequestedAuthnContext} if warranted.
*
* @param profileRequestContext current profile request context
- * @param builder object builder
*
* @return the object to include in the request, or null
*/
@Nullable private RequestedAuthnContext getRequestedAuthnContext(
- @Nullable final ProfileRequestContext profileRequestContext,
- @Nonnull final SAMLObjectBuilder<RequestedAuthnContext> builder) {
+ @Nullable final ProfileRequestContext profileRequestContext) {
// RequestedAuthnContext also based on profile configuration.
final List<Principal> principals = profileConfiguration.getDefaultAuthenticationMethods(profileRequestContext);
@@ -295,6 +300,11 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
return null;
}
+ final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
+ final SAMLObjectBuilder<RequestedAuthnContext> builder =
+ (SAMLObjectBuilder<RequestedAuthnContext>) bf.<RequestedAuthnContext>getBuilderOrThrow(
+ RequestedAuthnContext.DEFAULT_ELEMENT_NAME);
+
// Check for class refs.
final List<AuthnContextClassRefPrincipal> classRefPrincipals = principals.stream()
.filter(AuthnContextClassRefPrincipal.class::isInstance)
@@ -344,4 +354,47 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
return null;
}
+ /**
+ * Build a {@Scoping} element, decrementing the proxy count if set.
+ *
+ * @param profileRequestContext current profile request context
+ * @param count proxy count
+ * @param idplist list of IdP entityIDs
+ *
+ * @return populated {@link Scoping}
+ */
+ @Nullable public Scoping buildScoping(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nullable final Integer count, @Nonnull @NonnullElements final Set<String> idplist) {
+
+ if (count == null && idplist.isEmpty()) {
+ return null;
+ } else if (profileConfiguration.isIgnoreScoping(profileRequestContext)) {
+ log.warn("{} Skipping generation of Scoping element in violation of standard", getLogPrefix());
+ return null;
+ }
+
+ final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
+ final SAMLObjectBuilder<Scoping> scopingBuilder =
+ (SAMLObjectBuilder<Scoping>) bf.<Scoping>getBuilderOrThrow(Scoping.DEFAULT_ELEMENT_NAME);
+ final Scoping scoping = scopingBuilder.buildObject();
+ scoping.setProxyCount(Integer.min(0, count - 1));
+
+ if (!idplist.isEmpty()) {
+ final SAMLObjectBuilder<IDPList> idpListBuilder =
+ (SAMLObjectBuilder<IDPList>) bf.<IDPList>getBuilderOrThrow(IDPList.DEFAULT_ELEMENT_NAME);
+ final SAMLObjectBuilder<IDPEntry> idpBuilder =
+ (SAMLObjectBuilder<IDPEntry>) bf.<IDPEntry>getBuilderOrThrow(IDPEntry.DEFAULT_ELEMENT_NAME);
+
+ final IDPList idps = idpListBuilder.buildObject();
+ for (final String idp : idplist) {
+ final IDPEntry entry = idpBuilder.buildObject();
+ entry.setProviderID(idp);
+ idps.getIDPEntrys().add(entry);
+ }
+ scoping.setIDPList(idps);
+ }
+
+ return scoping;
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
index 9388220..1695b72 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
@@ -40,6 +40,8 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.google.common.base.Predicates;
+
/** {@link InitializeAuthenticationContext} unit test. */
public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCase {
@@ -122,7 +124,7 @@ public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCas
Assert.assertEquals(authnCtx.getProxyCount(), Integer.valueOf(1));
}
- @Test public void testAuthnRequestIgnored() throws ComponentInitializationException {
+ @Test public void testScopingIgnored() throws ComponentInitializationException {
final AuthnRequest authnRequest = SAML2ActionTestingSupport.buildAuthnRequest();
authnRequest.setIsPassive(true);
authnRequest.setForceAuthn(true);
@@ -136,7 +138,7 @@ public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCas
action = new InitializeAuthenticationContext();
action.setProxyCountLookupStrategy(FunctionSupport.constant(1));
- action.setHonorAuthnRequest(false);
+ action.setIgnoreScopingPredicate(Predicates.alwaysTrue());
action.initialize();
final Event event = action.execute(requestCtx);
@@ -144,8 +146,8 @@ public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCas
final AuthenticationContext authnCtx = prc.getSubcontext(AuthenticationContext.class);
Assert.assertNotNull(authnCtx);
- Assert.assertFalse(authnCtx.isForceAuthn());
- Assert.assertFalse(authnCtx.isPassive());
+ Assert.assertTrue(authnCtx.isForceAuthn());
+ Assert.assertTrue(authnCtx.isPassive());
Assert.assertEquals(authnCtx.getProxyCount(), Integer.valueOf(1));
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list