[java-identity-provider] 01/03: IDP-1919 - CAS validation flows don't run consent checking interceptor

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=02b8ea64954540e96fad18792ea43178a21ee811

commit 02b8ea64954540e96fad18792ea43178a21ee811
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 14 12:46:29 2022 -0400

    IDP-1919 - CAS validation flows don't run consent checking interceptor
    
    https://shibboleth.atlassian.net/browse/IDP-1919
    
    Added logic copied from SAML queries into validation abstract flow.
---
 .../idp/flows/cas/validate-abstract-beans.xml          |  9 +++++++++
 .../idp/flows/cas/validate-abstract-flow.xml           | 18 +++++++++++++++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-beans.xml
index af2e5abe8..9072b335f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-beans.xml
@@ -37,6 +37,15 @@
           c:validator="#{getObject('shibboleth.CASProxyAuthenticator') ?: getObject('shibboleth.DefaultCASProxyAuthenticator')}"
           c:ticketService="#{getObject('shibboleth.CASTicketService') ?: getObject('shibboleth.DefaultCASTicketService')}" />
 
+    <bean id="PopulateConsentInterceptContext"
+            class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
+            p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+            p:loggingLabel="backchannel">
+        <property name="activeFlowsLookupStrategy">
+            <bean parent="shibboleth.Functions.Constant" c:target="#{ {'attribute-release-query' } }" />
+        </property>
+    </bean>
+
     <bean id="PrepareTicketValidationResponse"
           class="net.shibboleth.idp.cas.flow.impl.PrepareTicketValidationResponseAction" scope="prototype"
           p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-flow.xml
index 4fb20160f..35ab9e993 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-flow.xml
@@ -74,9 +74,25 @@
         <evaluate expression="ResolveAttributes" />
         <evaluate expression="FilterAttributes" />
         <evaluate expression="'proceed'" />
-        <transition on="proceed" to="UpdateIdPSessionWithSPSession" />
+        <transition on="proceed" to="CheckConsentCondition" />
     </action-state>
 
+    <decision-state id="CheckConsentCondition">
+        <if test="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.consent.AttributeQuery.Condition') and flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.consent.AttributeQuery.Condition').apply(opensamlProfileRequestContext)"
+            then="ConsentSetup" else="UpdateIdPSessionWithSPSession" />
+    </decision-state>
+
+    <action-state id="ConsentSetup">
+        <evaluate expression="PopulateConsentInterceptContext" />
+        <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).setAttemptedFlow(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.ProfileInterceptorFlowDescriptorManager').getComponents().?[id matches 'intercept/attribute-release-query'])" />
+        <transition on="success" to="ConsentFlow" />
+    </action-state>
+
+    <subflow-state id="ConsentFlow" subflow="intercept/attribute-release-query">
+        <input name="calledAsSubflow" value="true" />
+        <transition on="proceed" to="UpdateIdPSessionWithSPSession"/>
+    </subflow-state>
+
     <action-state id="UpdateIdPSessionWithSPSession">
         <evaluate expression="UpdateIdPSessionWithSPSession" />
         <evaluate expression="PopulateOutboundInterceptContext" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.