[java-identity-provider] branch master updated: Allow ignored AuthnContext content when blocking requested contexts.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e8b2cffa89c943cc7290841a9a6470dac57e9c2f

The following commit(s) were added to refs/heads/master by this push:
       new  e8b2cff   Allow ignored AuthnContext content when blocking requested contexts.
e8b2cff is described below

commit e8b2cffa89c943cc7290841a9a6470dac57e9c2f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 3 13:25:08 2019 -0400

    Allow ignored AuthnContext content when blocking requested contexts.
---
 .../profile/impl/ProcessRequestedAuthnContext.java | 24 +++++++++++-----------
 .../impl/ProcessRequestedAuthnContextTest.java     | 17 +++++++++++++++
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
index 477b772..b1dfbad 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
@@ -172,18 +172,6 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
             return;
         }
         
-        // Check if permitted.
-        final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
-        if (rpContext != null && rpContext.getProfileConfig() != null
-                && rpContext.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
-            if (((BrowserSSOProfileConfiguration) rpContext.getProfileConfig()).isFeatureDisallowed(
-                    profileRequestContext, BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT)) {
-                log.warn("{} Incoming RequestedAuthnContext disallowed by profile configuration", getLogPrefix());
-                ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
-                return;
-            }
-        }
-
         final List<Principal> principals = new ArrayList<>();
         
         if (!requestedCtx.getAuthnContextClassRefs().isEmpty()) {
@@ -213,6 +201,18 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
             return;
         }
 
+        // Check if permitted.
+        final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
+        if (rpContext != null && rpContext.getProfileConfig() != null
+                && rpContext.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
+            if (((BrowserSSOProfileConfiguration) rpContext.getProfileConfig()).isFeatureDisallowed(
+                    profileRequestContext, BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT)) {
+                log.warn("{} Incoming RequestedAuthnContext disallowed by profile configuration", getLogPrefix());
+                ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+                return;
+            }
+        }
+        
         final RequestedPrincipalContext rpCtx = new RequestedPrincipalContext();
         if (requestedCtx.getComparison() != null) {
             rpCtx.setOperator(requestedCtx.getComparison().toString());
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java
index a268eca..81fba35 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java
@@ -114,6 +114,7 @@ public class ProcessRequestedAuthnContextTest extends OpenSAMLInitBaseTestCase {
         final RequestedAuthnContext rac = racBuilder.buildObject();
         ((AuthnRequest) prc.getInboundMessageContext().getMessage()).setRequestedAuthnContext(rac);
         final AuthnContextClassRef ref = classBuilder.buildObject();
+        ref.setAuthnContextClassRef(AuthnContext.PASSWORD_AUTHN_CTX);
         rac.getAuthnContextClassRefs().add(ref);
         
         ((BrowserSSOProfileConfiguration) prc.getSubcontext(RelyingPartyContext.class).getProfileConfig()).setDisallowedFeatures(
@@ -123,6 +124,22 @@ public class ProcessRequestedAuthnContextTest extends OpenSAMLInitBaseTestCase {
         ActionTestingSupport.assertEvent(event, AuthnEventIds.INVALID_AUTHN_CTX);
         Assert.assertNull(ac.getSubcontext(RequestedPrincipalContext.class));
     }
+
+    @Test public void testDisallowedButIgnored() {
+        prc.getInboundMessageContext().setMessage(SAML2ActionTestingSupport.buildAuthnRequest());
+        final RequestedAuthnContext rac = racBuilder.buildObject();
+        ((AuthnRequest) prc.getInboundMessageContext().getMessage()).setRequestedAuthnContext(rac);
+        final AuthnContextClassRef ref = classBuilder.buildObject();
+        ref.setAuthnContextClassRef(AuthnContext.UNSPECIFIED_AUTHN_CTX);
+        rac.getAuthnContextClassRefs().add(ref);
+        
+        ((BrowserSSOProfileConfiguration) prc.getSubcontext(RelyingPartyContext.class).getProfileConfig()).setDisallowedFeatures(
+                BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT);
+        
+        final Event event = action.execute(src);
+        ActionTestingSupport.assertProceedEvent(event);
+        Assert.assertNull(ac.getSubcontext(RequestedPrincipalContext.class));
+    }
     
     @Test public void testNoOperator() {
         prc.getInboundMessageContext().setMessage(SAML2ActionTestingSupport.buildAuthnRequest());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.