[java-identity-provider] branch main updated: IDP-995 - Administrative logout features

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d22b56e9f305b8dea949027e40fb4c73c17f3893

The following commit(s) were added to refs/heads/main by this push:
     new d22b56e9f IDP-995 - Administrative logout features
d22b56e9f is described below

commit d22b56e9f305b8dea949027e40fb4c73c17f3893
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 5 13:04:04 2023 -0500

    IDP-995 - Administrative logout features
    
    https://shibboleth.atlassian.net/browse/IDP-995
    
    Filter population of MFA active results via revocation condition.
    Allows "typical" MFA scripting to honor revocation without special care.
---
 .../idp/authn/impl/PopulateMultiFactorAuthenticationContext.java      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
index 2943138fc..a4b0f3d00 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
@@ -236,6 +236,10 @@ public class PopulateMultiFactorAuthenticationContext extends AbstractAuthentica
                                         authenticationContext.getMaxAge()).isBefore(Instant.now())) {
                             log.debug("{} Ignoring active result from login flow {} due to maxAge on request",
                                     getLogPrefix(), candidate.getAuthenticationFlowId());
+                        } else if (descriptor.getRevocationCondition() != null &&
+                                descriptor.getRevocationCondition().test(profileRequestContext, candidate)) {
+                            log.debug("{} Ignoring active but revoked result from login flow {}", getLogPrefix(),
+                                    candidate.getAuthenticationFlowId());
                         } else {
                             results.add(candidate);
                         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.