[java-identity-provider] branch main updated: IDP-995 - Administrative logout features

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=936fcfddc5ca042a76cab887cb358abb022fdb22

The following commit(s) were added to refs/heads/main by this push:
     new 936fcfddc IDP-995 - Administrative logout features
936fcfddc is described below

commit 936fcfddc5ca042a76cab887cb358abb022fdb22
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 4 15:24:35 2023 -0500

    IDP-995 - Administrative logout features
    
    https://shibboleth.atlassian.net/browse/IDP-995
    
    Add parallel delegating condition to ARs to accomodate MFA.
---
 .../shibboleth/idp/authn/AuthenticationResult.java | 31 +++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
index caea9cbc7..444ad4943 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
@@ -97,7 +97,11 @@ public class AuthenticationResult implements PrincipalSupportingComponent, Predi
         authenticationInstant = Instant.now();
         lastActivityInstant = authenticationInstant;
         additionalData = new HashMap<>();
+        
+        // These are defaulted in primarily as a safety valve for cases like the MFA flow
+        // where the result isn't built in the "normal" way.
         reuseCondition = new DescriptorReusePredicate();
+        revocationCondition = new DescriptorRevocationPredicate();
     }
 
     /**
@@ -364,7 +368,32 @@ public class AuthenticationResult implements PrincipalSupportingComponent, Predi
             
             return false;
         }
-        
     }
 
+    /**
+     * Inner class that delegates revocation condition evaluation to the underlying
+     * {@link AuthenticationFlowDescriptor}.
+     */
+    class DescriptorRevocationPredicate implements BiPredicate<ProfileRequestContext,AuthenticationResult> {
+
+        /** {@inheritDoc} */
+        public boolean test(@Nullable final ProfileRequestContext prc, @Nullable final AuthenticationResult result) {
+            if (prc != null) {
+                final AuthenticationContext ac = prc.getSubcontext(AuthenticationContext.class);
+                if (ac != null) {
+                    final AuthenticationFlowDescriptor flow = ac.getAvailableFlows().get(authenticationFlowId);
+                    if (flow != null) {
+                        if (flow.getRevocationCondition() != null) {
+                            return flow.getRevocationCondition().test(prc, result);
+                        } else {
+                            return false;
+                        }
+                    }
+                }
+            }
+            
+            return true;
+        }
+    }
+    
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.