[java-identity-provider] branch master updated: Select Assertion and AuthnStatement for authn using SessionNotOnOrAfter.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=bfcb641f5f59abe17a528ccb9b6848f5273c9551

The following commit(s) were added to refs/heads/master by this push:
       new  bfcb641   Select Assertion and AuthnStatement for authn using SessionNotOnOrAfter.
bfcb641 is described below

commit bfcb641f5f59abe17a528ccb9b6848f5273c9551
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Feb 5 19:53:56 2020 -0500

    Select Assertion and AuthnStatement for authn using SessionNotOnOrAfter.
---
 .../impl/ProcessAssertionsForAuthentication.java   | 30 ++++++++++++++++------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
index 139727e..297986d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
@@ -17,7 +17,10 @@
 
 package net.shibboleth.idp.saml.saml2.profile.impl;
 
+import java.time.Instant;
+import java.util.Comparator;
 import java.util.List;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.function.Function;
 import java.util.function.Predicate;
@@ -87,15 +90,26 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
         samlContextLookupStrategy = new ChildContextLookup<>(SAMLAuthnContext.class).compose(
                 new ChildContextLookup<>(AuthenticationContext.class));
         
-        //TODO replace with better default logic based on Scott review and SP behavior
-        authnAssertionSelectionStrategy = assertions -> {
-            return assertions.get(0);
-        };
+        // Get the Assertion containing the earliest child AuthnStatement#SessionNotOnOrAfter,
+        // with null values converted to Instant.MAX and therefore having the lowest precedence.
+        authnAssertionSelectionStrategy = assertions -> assertions.stream()
+                .filter(Objects::nonNull)
+                // Sort with key extractor which extracts the lowest-valued AuthnStatement#SessionNotOnOrAfter value,
+                // or Instant.Max if all are null
+                .sorted(Comparator.<Assertion,Instant>comparing(assertion -> assertion.getAuthnStatements().stream()
+                        .filter(Objects::nonNull)
+                        .map(AuthnStatement::getSessionNotOnOrAfter)
+                        .filter(Objects::nonNull)
+                        .sorted()
+                        .findFirst().orElse(Instant.MAX)))
+                .findFirst().orElse(null);
             
-        //TODO replace with better default logic based on Scott review and SP behavior 
-        authnStatementSelectionStrategy = assertion -> {
-            return assertion.getAuthnStatements().get(0);
-        };
+        // Get the AuthnStatement with the earliest SessionNotOnOrAfter, with null values having lowest precedence.
+        authnStatementSelectionStrategy = assertion -> assertion.getAuthnStatements().stream()
+                    .filter(Objects::nonNull)
+                    .sorted(Comparator.comparing(AuthnStatement::getSessionNotOnOrAfter,
+                            Comparator.nullsLast(Comparator.naturalOrder())))
+                    .findFirst().orElse(null);
     }
 
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.