[java-identity-provider] 20/23: IDP-2255 - Warn if defaultAuthnMethods used without disallowedFeatures

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-5.1
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d047981f2f144ed781dc42cc4ea2337a7e6a990c

commit d047981f2f144ed781dc42cc4ea2337a7e6a990c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 18 15:44:44 2025 -0500

    IDP-2255 - Warn if defaultAuthnMethods used without disallowedFeatures
    
    https://shibboleth.atlassian.net/browse/IDP-2255
    
    Reordered code in InitializeRequestedPrincipalContext action.
---
 .../authn/impl/InitializeRequestedPrincipalContext.java | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
index fcc3933c4..c3bf3c369 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/InitializeRequestedPrincipalContext.java
@@ -105,10 +105,6 @@ public class InitializeRequestedPrincipalContext extends AbstractAuthenticationA
         
         if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
             return false;
-        } else if (authenticationContext.getSubcontext(RequestedPrincipalContext.class) != null
-                && !replaceExistingContext) {
-            log.debug("{} Leaving existing RequestedPrincipalContext in place", getLogPrefix());
-            return false;
         }
         
         final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
@@ -147,6 +143,19 @@ public class InitializeRequestedPrincipalContext extends AbstractAuthenticationA
             return;
         }
 
+        if (authenticationContext.getSubcontext(RequestedPrincipalContext.class) != null) {
+            if (replaceExistingContext) {
+                log.info("{} Replacing explicitly requested authentication criteria from relying party",
+                        getLogPrefix());
+                // continue to process profile-driven setting below
+            } else {
+                log.warn("{} Profile config overridden by explicitly requested authentication criteria, " +
+                        "consider disallowing with disallowedFeatures property", getLogPrefix());
+                return;
+            }
+        }
+        
+        
         final RequestedPrincipalContext principalCtx = new RequestedPrincipalContext();
         principalCtx.setOperator("exact");
         principalCtx.setRequestedPrincipals(principals);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.