[java-identity-provider] branch main updated: IDP-1867 - No attribute context available for authnContextTranslationStrategyEx hook

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=128b1d3820d8f8d8327c9c1a185abd69eb979221

The following commit(s) were added to refs/heads/main by this push:
     new 128b1d382 IDP-1867 - No attribute context available for authnContextTranslationStrategyEx hook
128b1d382 is described below

commit 128b1d3820d8f8d8327c9c1a185abd69eb979221
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 13 13:38:02 2021 -0400

    IDP-1867 - No attribute context available for
    authnContextTranslationStrategyEx hook
    
    https://shibboleth.atlassian.net/browse/IDP-1867
---
 .../profile/impl/ValidateSAMLAuthentication.java   | 52 ++++++++++++++--------
 1 file changed, 34 insertions(+), 18 deletions(-)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index f042bf944..666cbb740 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -287,7 +287,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         }
     }
         
-// Checkstyle: CyclomaticComplexity OFF
+// Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */
     @Override
     @Nonnull protected Subject populateSubject(@Nonnull final Subject subject) {
@@ -298,39 +298,55 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
 
         final AuthnContext authnContext = samlAuthnContext.getAuthnStatement().getAuthnContext();
         
+        boolean principalsAdded = false;
+        
         if (authnContextTranslatorEx != null) {
-            // PRC is two levels above SAMLAuthnContext.
+            // PRC is up (AuthenticationContext) and then down (to nested PRC).
             final Collection<Principal> translated = authnContextTranslatorEx.apply(
-                    (ProfileRequestContext) samlAuthnContext.getParent().getParent());
-            if (translated != null) {
+                    samlAuthnContext.getParent().getSubcontext(ProfileRequestContext.class));
+            if (translated != null && !translated.isEmpty()) {
                 subject.getPrincipals().addAll(translated);
                 if (log.isDebugEnabled()) {
                     log.debug("{} Added translated Principals: {}", getLogPrefix(),
                             translated.stream().map(Principal::getName).collect(Collectors.toUnmodifiableList()));
                 }
+                principalsAdded = true;
             }
-        } else if (authnContextTranslator != null) {
+        }
+        
+        if (!principalsAdded && authnContextTranslator != null) {
             final Collection<Principal> translated = authnContextTranslator.apply(authnContext);
-            if (translated != null) {
+            if (translated != null && !translated.isEmpty()) {
                 subject.getPrincipals().addAll(translated);
                 if (log.isDebugEnabled()) {
                     log.debug("{} Added translated AuthnContext Principals: {}", getLogPrefix(),
                             translated.stream().map(Principal::getName).collect(Collectors.toUnmodifiableList()));
                 }
+                principalsAdded = true;
             }
-        } else if (authnContext.getAuthnContextClassRef() != null) {
-            final String classRef = authnContext.getAuthnContextClassRef().getURI();
-            if (classRef != null) {
-                subject.getPrincipals().add(new AuthnContextClassRefPrincipal(classRef));
-                log.debug("{} Added AuthnContextClassRef from assertion: {}", getLogPrefix(), classRef);
+        }
+        
+        if (!principalsAdded) {
+            if (authnContext.getAuthnContextClassRef() != null) {
+                final String classRef = authnContext.getAuthnContextClassRef().getURI();
+                if (classRef != null) {
+                    subject.getPrincipals().add(new AuthnContextClassRefPrincipal(classRef));
+                    log.debug("{} Added AuthnContextClassRef from assertion: {}", getLogPrefix(), classRef);
+                }
+                principalsAdded = true;
             }
-        } else if (authnContext.getAuthnContextDeclRef() != null) {
-            final String declRef = authnContext.getAuthnContextDeclRef().getURI();
-            if (declRef != null) {
-                subject.getPrincipals().add(new AuthnContextDeclRefPrincipal(declRef));
-                log.debug("{} Added AuthnContextDeclRef from assertion: {}", getLogPrefix(), declRef);
+            
+            if (authnContext.getAuthnContextDeclRef() != null) {
+                final String declRef = authnContext.getAuthnContextDeclRef().getURI();
+                if (declRef != null) {
+                    subject.getPrincipals().add(new AuthnContextDeclRefPrincipal(declRef));
+                    log.debug("{} Added AuthnContextDeclRef from assertion: {}", getLogPrefix(), declRef);
+                }
+                principalsAdded = true;
             }
-        } else {
+        }
+        
+        if (!principalsAdded) {
             log.warn("{} No AuthnContext information usable from assertion", getLogPrefix());
         }
         
@@ -347,7 +363,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         
         return subject;
     }
-// Checkstyle: CyclomaticComplexity ON
+// Checkstyle: CyclomaticComplexity|MethodLength ON
     
     /**
      * Construct a populated {@link ProxyAuthenticationPrincipal} based on the inbound assertion.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.