[java-identity-provider] branch main updated: IDP-2383 - Distinguish IdP- vs SP-driven RequestedPrincipalContext

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=cfd9b7054c61ad73c3e63be303a4211e17e16ab6

The following commit(s) were added to refs/heads/main by this push:
     new cfd9b7054 IDP-2383 - Distinguish IdP- vs SP-driven RequestedPrincipalContext
cfd9b7054 is described below

commit cfd9b7054c61ad73c3e63be303a4211e17e16ab6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 10 08:58:12 2025 -0400

    IDP-2383 - Distinguish IdP- vs SP-driven RequestedPrincipalContext
    
    https://shibboleth.atlassian.net/browse/IDP-2383
---
 .../authn/context/RequestedPrincipalContext.java   | 32 +++++++++++++++++++++-
 .../impl/InitializeRequestedPrincipalContext.java  |  3 +-
 .../profile/impl/ProcessRequestedAuthnContext.java |  1 +
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
index 7896377f3..376a1d74c 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
@@ -60,13 +60,16 @@ public final class RequestedPrincipalContext extends BaseContext {
 
     /** The registry of predicate factories for custom principal evaluation. */
     @Nonnull private PrincipalEvalPredicateFactoryRegistry evalRegistry;
-
+    
     /** Comparison operator specific to request protocol. */
     @Nullable private String operatorString;
 
     /** The principals reflecting the request requirements. */
     @Nonnull private List<Principal> requestedPrincipals;
     
+    /** Whether the requirement was applied due to local policy? */
+    private boolean imposedLocally;
+    
     /** The principal that satisfied the request, if any. */
     @Nullable private Principal matchingPrincipal;
     
@@ -148,6 +151,33 @@ public final class RequestedPrincipalContext extends BaseContext {
         return this;
     }
     
+    /**
+     * Get whether the context was populated in response to a requirement applied by IdP policy.
+     * 
+     * <p>A false value implies that an RP/SP's requirement resulted in the creation of this context.</p>
+     * 
+     * @return true iff the context was populated due to local requirements applied by the IdP
+     * 
+     * @since 5.2.0
+     */
+    public boolean isImposedLocally() {
+        return imposedLocally;
+    }
+    
+    /**
+     * Set whether the context was populated in response to a requirement applied by IdP policy.
+     * 
+     * @param flag flag to set
+     * 
+     * @return this context
+     * 
+     * @since 5.2.0
+     */
+    @Nonnull public RequestedPrincipalContext setImposedLocally(final boolean flag) {
+        imposedLocally = flag;
+        return this;
+    }
+    
     /**
      * Get the principal that matched the request's requirements, if any.
      * 
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
index c3bf3c369..abce9e51b 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
@@ -157,6 +157,7 @@ public class InitializeRequestedPrincipalContext extends AbstractAuthenticationA
         
         
         final RequestedPrincipalContext principalCtx = new RequestedPrincipalContext();
+        principalCtx.setImposedLocally(true);
         principalCtx.setOperator("exact");
         principalCtx.setRequestedPrincipals(principals);
         principalCtx.setPrincipalEvalPredicateFactoryRegistry(
@@ -167,4 +168,4 @@ public class InitializeRequestedPrincipalContext extends AbstractAuthenticationA
                 principalCtx.getRequestedPrincipals().size());
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
index f39b3ad48..c6b4f6111 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
@@ -214,6 +214,7 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
             rpCtx.setOperator(AuthnContextComparisonTypeEnumeration.EXACT.toString());
         }
         rpCtx.setRequestedPrincipals(principals);
+        rpCtx.setImposedLocally(false);
         
         authenticationContext.addSubcontext(rpCtx, true);
         log.debug("{} RequestedPrincipalContext created with operator {} and {} custom principal(s)",

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.