[java-identity-provider] branch maint-4 updated: IDP-995 - Administrative logout features

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-4
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=a1c4b5089cb4a27d1a13b1ae8df4f009a434f4f6

The following commit(s) were added to refs/heads/maint-4 by this push:
     new a1c4b5089 IDP-995 - Administrative logout features
a1c4b5089 is described below

commit a1c4b5089cb4a27d1a13b1ae8df4f009a434f4f6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 5 13:04:04 2023 -0500

    IDP-995 - Administrative logout features
    
    https://shibboleth.atlassian.net/browse/IDP-995
    
    Filter population of MFA active results via revocation condition.
    Allows "typical" MFA scripting to honor revocation without special care.
---
 .../idp/authn/impl/PopulateMultiFactorAuthenticationContext.java      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
index d707ca7a3..f3bbc8537 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
@@ -240,6 +240,10 @@ public class PopulateMultiFactorAuthenticationContext extends AbstractAuthentica
                                         authenticationContext.getMaxAge()).isBefore(Instant.now())) {
                             log.debug("{} Ignoring active result from login flow {} due to maxAge on request",
                                     getLogPrefix(), candidate.getAuthenticationFlowId());
+                        } else if (descriptor.getRevocationCondition() != null &&
+                                descriptor.getRevocationCondition().test(profileRequestContext, candidate)) {
+                            log.debug("{} Ignoring active but revoked result from login flow {}", getLogPrefix(),
+                                    candidate.getAuthenticationFlowId());
                         } else {
                             results.add(candidate);
                         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.