again.. save THEN commit

[java-idp.git] / src / edu / internet2 / middleware / shibboleth / idp / authn / AuthenticationEngine.java

diff --git a/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java b/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
index 948dda8..4b7955b 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
@@ -26,6 +26,7 @@ import java.util.Map.Entry;
 
 import javax.security.auth.Subject;
 import javax.servlet.RequestDispatcher;
+import javax.servlet.ServletConfig;
 import javax.servlet.ServletException;
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServlet;
@@ -61,23 +62,28 @@ public class AuthenticationEngine extends HttpServlet {
     /** Class logger. */
     private static final Logger LOG = LoggerFactory.getLogger(AuthenticationEngine.class);
 
-    /**
-     * Gets the manager used to retrieve handlers for requests.
-     * 
-     * @return manager used to retrieve handlers for requests
-     */
-    public IdPProfileHandlerManager getProfileHandlerManager() {
-        return (IdPProfileHandlerManager) getServletContext().getAttribute("handlerManager");
-    }
+    /** Profile handler manager. */
+    private IdPProfileHandlerManager handlerManager;
 
-    /**
-     * Gets the session manager to be used.
-     * 
-     * @return session manager to be used
-     */
-    @SuppressWarnings("unchecked")
-    public SessionManager<Session> getSessionManager() {
-        return (SessionManager<Session>) getServletContext().getAttribute("sessionManager");
+    /** Session manager. */
+    private SessionManager<Session> sessionManager;
+
+    /** {@inheritDoc} */
+    public void init(ServletConfig config) throws ServletException {
+        super.init(config);
+
+        String handlerManagerId = config.getInitParameter("handlerManagerId");
+        if (DatatypeHelper.isEmpty(handlerManagerId)) {
+            handlerManagerId = "shibboleth.HandlerManager";
+        }
+        handlerManager = (IdPProfileHandlerManager) getServletContext().getAttribute(handlerManagerId);
+
+        String sessionManagerId = config.getInitParameter("sessionManagedId");
+        if (DatatypeHelper.isEmpty(handlerManagerId)) {
+            sessionManagerId = "shibboleth.SessionManager";
+        }
+
+        sessionManager = (SessionManager<Session>) getServletContext().getAttribute(sessionManagerId);
     }
 
     /**
@@ -92,8 +98,10 @@ public class AuthenticationEngine extends HttpServlet {
         LoginContext loginContext = (LoginContext) httpSession.getAttribute(LoginContext.LOGIN_CONTEXT_KEY);
         if (loginContext == null) {
             LOG.error("User HttpSession did not contain a login context.  Unable to return to authentication engine");
+            forwardRequest("/idp-error.jsp", httpRequest, httpResponse);
+        } else {
+            forwardRequest(loginContext.getAuthenticationEngineURL(), httpRequest, httpResponse);
         }
-        forwardRequest(loginContext.getAuthenticationEngineURL(), httpRequest, httpResponse);
     }
 
     /**
@@ -106,6 +114,7 @@ public class AuthenticationEngine extends HttpServlet {
     public static void returnToProfileHandler(LoginContext loginContext, HttpServletRequest httpRequest,
             HttpServletResponse httpResponse) {
         LOG.debug("Returning control to profile handler at: {}", loginContext.getProfileHandlerURL());
+        httpRequest.getSession().removeAttribute(LoginContext.LOGIN_CONTEXT_KEY);
         httpRequest.setAttribute(LoginContext.LOGIN_CONTEXT_KEY, loginContext);
         forwardRequest(loginContext.getProfileHandlerURL(), httpRequest, httpResponse);
     }
@@ -146,9 +155,6 @@ public class AuthenticationEngine extends HttpServlet {
             // The authn engine attaches it to the session to allow the handlers to do any number of
             // request/response pairs without maintaining or losing the login context
             loginContext = (LoginContext) httpRequest.getSession().getAttribute(LoginContext.LOGIN_CONTEXT_KEY);
-        } else {
-            // Clean out any old state that might be lying around
-            httpRequest.getSession().removeAttribute(LoginContext.LOGIN_CONTEXT_KEY);
         }
 
         if (loginContext == null) {
@@ -228,7 +234,7 @@ public class AuthenticationEngine extends HttpServlet {
      */
     protected Map<String, LoginHandler> determinePossibleLoginHandlers(LoginContext loginContext)
             throws AuthenticationException {
-        Map<String, LoginHandler> supportedLoginHandlers = new HashMap<String, LoginHandler>(getProfileHandlerManager()
+        Map<String, LoginHandler> supportedLoginHandlers = new HashMap<String, LoginHandler>(handlerManager
                 .getLoginHandlers());
         LOG.trace("Supported login handlers: {}", supportedLoginHandlers);
         LOG.trace("Requested authentication methods: {}", loginContext.getRequestedAuthenticationMethods());
@@ -326,8 +332,8 @@ public class AuthenticationEngine extends HttpServlet {
         loginContext.setAuthenticationDuration(logingHandler.getAuthenticationDuration());
         loginContext.setAuthenticationMethod(authnMethod);
         loginContext.setAuthenticationEngineURL(HttpHelper.getRequestUriWithoutContext(httpRequest));
-        logingHandler.login(httpRequest, httpResponse);
         httpRequest.getSession().setAttribute(LoginContext.LOGIN_CONTEXT_KEY, loginContext);
+        logingHandler.login(httpRequest, httpResponse);
     }
 
     /**
@@ -396,10 +402,9 @@ public class AuthenticationEngine extends HttpServlet {
             loginContext.setAuthenticationMethod(actualAuthnMethod);
         }
 
-        updateUserSession(loginContext, httpRequest, httpResponse);
-
-        LOG.debug("User {} authentication with authentication method {}", loginContext.getPrincipalName(), loginContext
+        LOG.debug("User {} authenticated with method {}", loginContext.getPrincipalName(), loginContext
                 .getAuthenticationMethod());
+        updateUserSession(loginContext, httpRequest, httpResponse);
         returnToProfileHandler(loginContext, httpRequest, httpResponse);
     }
 
@@ -416,7 +421,7 @@ public class AuthenticationEngine extends HttpServlet {
         Session shibSession = (Session) httpRequest.getAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);
         if (shibSession == null) {
             LOG.debug("Creating shibboleth session for principal {}", loginContext.getPrincipalName());
-            shibSession = (Session) getSessionManager().createSession(loginContext.getPrincipalName());
+            shibSession = (Session) sessionManager.createSession(loginContext.getPrincipalName());
             loginContext.setSessionID(shibSession.getSessionID());
             addSessionCookie(httpRequest, httpResponse, shibSession);
         }
@@ -454,9 +459,7 @@ public class AuthenticationEngine extends HttpServlet {
         Cookie sessionCookie = new Cookie(IDP_SESSION_COOKIE_NAME, userSession.getSessionID());
         sessionCookie.setPath(httpRequest.getContextPath());
         sessionCookie.setSecure(false);
-
-        int maxAge = (int) (userSession.getInactivityTimeout() / 1000);
-        sessionCookie.setMaxAge(maxAge);
+        sessionCookie.setMaxAge(-1);
 
         httpResponse.addCookie(sessionCookie);
     }