tag attempted authentication trip

[java-idp.git] / src / edu / internet2 / middleware / shibboleth / idp / authn / AuthenticationEngine.java

diff --git a/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java b/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
index c96aca9..2f1ff69 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
@@ -183,7 +183,12 @@ public class AuthenticationEngine extends HttpServlet {
         LOG.debug("Beginning user authentication process");
         try {
             Session idpSession = (Session) httpRequest.getAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);
+            if(idpSession != null){
+                LOG.debug("Existing IdP session available for principal {}", idpSession.getPrincipalName());
+            }
+            
             Map<String, LoginHandler> possibleLoginHandlers = determinePossibleLoginHandlers(loginContext);
+            LOG.debug("Possible authentication handlers for this request: {}", possibleLoginHandlers);
 
             // Filter out possible candidate login handlers by forced and passive authentication requirements
             if (loginContext.isForceAuthRequired()) {
@@ -193,9 +198,10 @@ public class AuthenticationEngine extends HttpServlet {
             if (loginContext.isPassiveAuthRequired()) {
                 filterByPassiveAuthentication(loginContext, possibleLoginHandlers);
             }
-
+            
             // If the user already has a session and its usage is acceptable than use it
             // otherwise just use the first candidate login handler
+            LOG.debug("Possible authentication handlers after filtering: {}", possibleLoginHandlers);
             if (idpSession != null
                     && possibleLoginHandlers.containsKey(PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD)) {
                 authenticateUserWithPreviousSession(loginContext, possibleLoginHandlers, httpRequest, httpResponse);
@@ -208,7 +214,6 @@ public class AuthenticationEngine extends HttpServlet {
             loginContext.setAuthenticationFailure(e);
             returnToProfileHandler(loginContext, httpRequest, httpResponse);
         }
-
     }
 
     /**
@@ -231,8 +236,8 @@ public class AuthenticationEngine extends HttpServlet {
         Entry<String, LoginHandler> supportedLoginHandler;
         while (supportedLoginHandlerItr.hasNext()) {
             supportedLoginHandler = supportedLoginHandlerItr.next();
-            if (supportedLoginHandler.getKey().equals(PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD)
-                    || !loginContext.getRequestedAuthenticationMethods().contains(supportedLoginHandler.getKey())) {
+            if (!(supportedLoginHandler.getKey().equals(PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD))
+                    && !loginContext.getRequestedAuthenticationMethods().contains(supportedLoginHandler.getKey())) {
                 supportedLoginHandlerItr.remove();
                 continue;
             }
@@ -277,6 +282,9 @@ public class AuthenticationEngine extends HttpServlet {
                 }
             }
         }
+        
+        LOG.debug("Authentication handlers remaining after forced authentication requirement filtering: {}",
+                loginHandlers);
 
         if (loginHandlers.isEmpty()) {
             LOG.error("Force authentication required but no login handlers available to support it");
@@ -305,6 +313,9 @@ public class AuthenticationEngine extends HttpServlet {
                 authnMethodItr.remove();
             }
         }
+        
+        LOG.debug("Authentication handlers remaining after passive authentication requirement filtering: {}",
+                loginHandlers);
 
         if (loginHandlers.isEmpty()) {
             LOG.error("Passive authentication required but no login handlers available to support it");
@@ -348,6 +359,7 @@ public class AuthenticationEngine extends HttpServlet {
         }
         loginContext.setPrincipalName(idpSession.getPrincipalName());
 
+        loginContext.setAuthenticationAttempted();
         httpRequest.getSession().setAttribute(LoginContext.LOGIN_CONTEXT_KEY, loginContext);
         loginHandler.login(httpRequest, httpResponse);
     }