[java-idp-plugin-duo] branch dev/JDUO-80 updated: Limit name recovery from session to cases where active results exist.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/JDUO-80
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=1affdd2b185b646f8a774d4b955f20a7c0963e5b

The following commit(s) were added to refs/heads/dev/JDUO-80 by this push:
     new 1affdd2b Limit name recovery from session to cases where active results exist.
1affdd2b is described below

commit 1affdd2b185b646f8a774d4b955f20a7c0963e5b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 3 13:55:31 2024 -0500

    Limit name recovery from session to cases where active results exist.
---
 .../plugin/authn/duo/impl/CheckPasswordlessEnrollment.java   | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
index 62d6728a..fee80f1b 100644
--- a/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
+++ b/idp-duo-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/impl/CheckPasswordlessEnrollment.java
@@ -105,7 +105,9 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
                         new ChildContextLookup<>(AuthenticationContext.class));
         
         // TODO: BiPredicateSupport.alwaysFalse once API is bumped.
-        passwordlessCondition = (a,b) -> { return false; };
+        passwordlessCondition = (a,b) -> {
+            return false;
+            };
             
         usernameFieldName = "j_username";
         ssoBypassFieldName = "donotcache";
@@ -248,7 +250,7 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
                     usernameChanged = true;
                 }
             } else {
-                username = getUsernameFromSession(profileRequestContext);
+                username = getUsernameFromSession(profileRequestContext, authenticationContext);
                 if (username != null && !username.equals(passwordlessContext.getUsername())) {
                     log.debug("{} Populating username '{}' from session into Duo passwordless context", getLogPrefix(),
                             username);
@@ -337,12 +339,14 @@ public class CheckPasswordlessEnrollment extends AbstractExtractionAction {
      * Gets the username from an existing {@link IdPSession}, if any.
      * 
      * @param profileRequestContext profile request context
+     * @param authenticationContext authentication context
      * 
      * @return username from existing session, or null
      */
-    @Nullable private String getUsernameFromSession(@Nonnull final ProfileRequestContext profileRequestContext) {
+    @Nullable private String getUsernameFromSession(@Nonnull final ProfileRequestContext profileRequestContext,
+            @Nonnull final AuthenticationContext authenticationContext) {
         
-        if (checkSession) {
+        if (checkSession && !authenticationContext.getActiveResults().isEmpty()) {
             final SessionContext sessionContext = profileRequestContext.getSubcontext(SessionContext.class);
             if (sessionContext != null) {
                 final IdPSession idpSession = sessionContext.getIdPSession();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.