VelocityVariable passwordPrincipals

[Francesco Malvezzi]

hi everybody,

if you don't want to change the login view, I think it's possibile to 
move the logic from the view to the controller.

In conf/authn/mfa-auth-config.xml, change the starting transition from

<util:map id="shibboleth.authn.MFA.TransitionMap">
         <!-- First rule shows the Password login view. -->
          <entry key="">
             <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlow="authn/Password" />
          </entry>
[...]
  </util:map>

to:

<util:map id="shibboleth.authn.MFA.TransitionMap">
         <!-- First rule shows the Password login view and adds a flag 
to help the view display correctly when username/password form needs to 
be hidden . -->
         <entry key="">
             <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlowStrategy-ref="redirectToView" />
         </entry>

        [...]
     </util:map>

and add the following:

     // used to be defined in conf/authn/password-authn-config.xml
     <util:list id="shibboleth.authn.Password.PrincipalOverride">
         <bean parent="shibboleth.SAML2AuthnContextClassRef"
 
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" 
/>
         <bean parent="shibboleth.SAML2AuthnContextClassRef"
             c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
         <bean parent="shibboleth.SAML1AuthenticationMethod"
             c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
     </util:list>

     <bean id="redirectToView" 
parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
           p:customObject-ref="shibboleth.authn.Password.PrincipalOverride">
         <constructor-arg>
             <value>
                 <![CDATA[
		        logger = 
Java.type("org.slf4j.LoggerFactory").getLogger("edu.example.shibboleth.mfa");
                 nextFlow = "authn/Password";
                 // the task of this code is to smuggle $passwordEnabled 
flag to view
                 var passwordPrincipals = custom;
                 authCtx = 
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                 logger.debug("isAcceptable? {}", 
authCtx.isAcceptable(passwordPrincipals));
                 stateMap = authCtx.getAuthenticationStateMap();
                 if (authCtx.isAcceptable(passwordPrincipals)) {
                     stateMap.put('passwordEnabled', true);
                 } else {
                     stateMap.put('passwordEnabled', false);
                 }
		logger.debug("stateMap: {}", authCtx.getAuthenticationStateMap());
                 nextFlow;
             ]]>
             </value>
         </constructor-arg>
     </bean>

Now, remove the logic from views/login.vm, by substituting this:
[...]
#set ($passwordEnabled = false)
#if (!$passwordPrincipals or $passwordPrincipals.isEmpty() or 
$authenticationContext.isAcceptable($passwordPrincipals))
   #set ($passwordEnabled = true)
#end
[...]


with this:
[...]
#set ($stateMap = $authenticationContext.getAuthenticationStateMap())
#set ($passwordEnabled = $stateMap.get('passwordEnabled'))
[...]

Thank you for your time if you feel to review the code,

Francesco