[java-idp-plugin-oidc-rp] branch main updated: Strength forceAuthn requirement

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=7add0c4bb8cba6bdcb084dbe97e35a66ab0ccef2

The following commit(s) were added to refs/heads/main by this push:
     new 7add0c4  Strength forceAuthn requirement
7add0c4 is described below

commit 7add0c4bb8cba6bdcb084dbe97e35a66ab0ccef2
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Apr 21 09:39:36 2023 +0100

    Strength forceAuthn requirement
---
 .../rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java |  2 +-
 .../messaging/impl/AddForceAuthenticationPromptHandler.java  | 12 ++++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
index 93c1ca1..2d04aec 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
@@ -67,7 +67,7 @@ public class DefaultAuthCodeTokenRequestEncoder extends AbstractRequestEncoderFu
     }
     
     /**
-     * Convert the internally used Nimbus {@link HTTPRequest} to the externally presented {@link HttpUriRequest}.
+     * Convert the internally used {@link HTTPRequest} to the externally presented {@link HttpUriRequest}.
      * 
      * @param request the HTTP request to convert
      * 
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandler.java
index 1078165..f3fb557 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandler.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
 
+import java.time.Duration;
+
 import javax.annotation.Nonnull;
 
 import org.opensaml.messaging.context.MessageContext;
@@ -28,8 +30,8 @@ import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.openid.connect.sdk.Prompt;
 
 /** 
- * An action that sets the 'prompt' parameter to 'login' if force authn was requested by the upstream SP - is
- * is overridden in the profile config.
+ * An action that sets the 'prompt' parameter to 'login' and max_age to 0 seconds, iff force authn was requested by the 
+ * upstream SP (or is overridden in the profile config).
  */
 public class AddForceAuthenticationPromptHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
     
@@ -40,12 +42,14 @@ public class AddForceAuthenticationPromptHandler extends AbstractOIDCAuthenticat
             throws MessageHandlerException {
         
         if (getProfileConfiguration().isForceAuthn(lookupProfileRequestContext(messageContext))) {
-            log.trace("{} Setting prompt=login (ForceAuthn) for OIDC AuthnRequest", getLogPrefix());
+            log.trace("{} Setting prompt=login and max_age=0 (ForceAuthn) for OIDC AuthnRequest", getLogPrefix());
             try {
                 getAuthenticationRequest().setPrompt(Prompt.parse(Prompt.Type.LOGIN.toString()));
+                getAuthenticationRequest().setMaxAge(Duration.ofSeconds(0));
             } catch (final ParseException e) {
                 // This should never happen
-                throw new MessageHandlerException("Unable to honour force-authn, setting prompt to 'login' failed", e);
+                throw new MessageHandlerException("Unable to honour force-authn, "
+                        + "setting prompt to force-login as failed", e);
             }
         } else {
             log.trace("{} No ForceAuthn requirement, so no prompt set", getLogPrefix());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.