Treat unspec authentication method as meaning "any"

git-svn-id: https://subversion.switch.ch/svn/shibboleth/java-idp/trunk@2697 ab3bd59b-922f-494d-bb5f-6f0a3c29deca

diff --git a/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java b/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
index ea883bf..9f33c78 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
@@ -34,6 +34,7 @@ import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
 import org.joda.time.DateTime;
+import org.opensaml.saml2.core.AuthnContext;
 import org.opensaml.xml.util.DatatypeHelper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -183,10 +184,10 @@ public class AuthenticationEngine extends HttpServlet {
         LOG.debug("Beginning user authentication process");
         try {
             Session idpSession = (Session) httpRequest.getAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);
-            if(idpSession != null){
+            if (idpSession != null) {
                 LOG.debug("Existing IdP session available for principal {}", idpSession.getPrincipalName());
             }
-            
+
             Map<String, LoginHandler> possibleLoginHandlers = determinePossibleLoginHandlers(loginContext);
             LOG.debug("Possible authentication handlers for this request: {}", possibleLoginHandlers);
 
@@ -198,15 +199,14 @@ public class AuthenticationEngine extends HttpServlet {
             if (loginContext.isPassiveAuthRequired()) {
                 filterByPassiveAuthentication(loginContext, possibleLoginHandlers);
             }
-            
+
             // If the user already has a session and its usage is acceptable than use it
             // otherwise just use the first candidate login handler
             LOG.debug("Possible authentication handlers after filtering: {}", possibleLoginHandlers);
-            if (idpSession != null
-                    && possibleLoginHandlers.containsKey(PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD)) {
+            if (idpSession != null && possibleLoginHandlers.containsKey(AuthnContext.PREVIOUS_SESSION_AUTHN_CTX)) {
                 authenticateUserWithPreviousSession(loginContext, possibleLoginHandlers, httpRequest, httpResponse);
             } else {
-                possibleLoginHandlers.remove(PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD);
+                possibleLoginHandlers.remove(AuthnContext.PREVIOUS_SESSION_AUTHN_CTX);
                 Entry<String, LoginHandler> chosenLoginHandler = possibleLoginHandlers.entrySet().iterator().next();
                 authenticateUser(chosenLoginHandler.getKey(), chosenLoginHandler.getValue(), loginContext, httpRequest,
                         httpResponse);
@@ -233,13 +233,20 @@ public class AuthenticationEngine extends HttpServlet {
         LOG.trace("Supported login handlers: {}", supportedLoginHandlers);
         LOG.trace("Requested authentication methods: {}", loginContext.getRequestedAuthenticationMethods());
 
+        // If no preferences Authn method preference is given, then we're free to use any
+        if (loginContext.getRequestedAuthenticationMethods().isEmpty()) {
+            LOG.trace("No preference given for authentication methods");
+            return supportedLoginHandlers;
+        }
+
+        // Otherwise we need to filter all the mechanism supported by the IdP so that only the request types are left
+        // Previous session handler is a special case, we always to keep that around if it's configured
         Iterator<Entry<String, LoginHandler>> supportedLoginHandlerItr = supportedLoginHandlers.entrySet().iterator();
         Entry<String, LoginHandler> supportedLoginHandler;
         while (supportedLoginHandlerItr.hasNext()) {
             supportedLoginHandler = supportedLoginHandlerItr.next();
-            if (!(supportedLoginHandler.getKey().equals(PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD))
-                    && !loginContext.getRequestedAuthenticationMethods().contains(supportedLoginHandler.getKey())) {
-// treat no req method as any
+            if (!supportedLoginHandler.getKey().equals(AuthnContext.PREVIOUS_SESSION_AUTHN_CTX) && !loginContext
+                    .getRequestedAuthenticationMethods().contains(supportedLoginHandler.getKey())) {
                 supportedLoginHandlerItr.remove();
                 continue;
             }
@@ -284,7 +291,7 @@ public class AuthenticationEngine extends HttpServlet {
                 }
             }
         }
-        
+
         LOG.debug("Authentication handlers remaining after forced authentication requirement filtering: {}",
                 loginHandlers);
 
@@ -315,7 +322,7 @@ public class AuthenticationEngine extends HttpServlet {
                 authnMethodItr.remove();
             }
         }
-        
+
         LOG.debug("Authentication handlers remaining after passive authentication requirement filtering: {}",
                 loginHandlers);
 
@@ -340,7 +347,7 @@ public class AuthenticationEngine extends HttpServlet {
 
         Session idpSession = (Session) httpRequest.getAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);
         PreviousSessionLoginHandler loginHandler = (PreviousSessionLoginHandler) handlerManager.getLoginHandlers().get(
-                PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD);
+                AuthnContext.PREVIOUS_SESSION_AUTHN_CTX);
 
         AuthenticationMethodInformation authenticationMethod = null;
         for (String possibleAuthnMethod : possibleLoginHandlers.keySet()) {
@@ -353,7 +360,7 @@ public class AuthenticationEngine extends HttpServlet {
         if (loginHandler.reportPreviousSessionAuthnMethod()) {
             loginContext.setAuthenticationDuration(loginHandler.getAuthenticationDuration());
             loginContext.setAuthenticationInstant(new DateTime());
-            loginContext.setAuthenticationMethod(PreviousSessionLoginHandler.PREVIOUS_SESSION_AUTHN_METHOD);
+            loginContext.setAuthenticationMethod(AuthnContext.PREVIOUS_SESSION_AUTHN_CTX);
         } else {
             loginContext.setAuthenticationDuration(authenticationMethod.getAuthenticationDuration());
             loginContext.setAuthenticationInstant(authenticationMethod.getAuthenticationInstant());

diff --git a/src/edu/internet2/middleware/shibboleth/idp/authn/Saml2LoginContext.java b/src/edu/internet2/middleware/shibboleth/idp/authn/Saml2LoginContext.java
index 543e851..645ac95 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/authn/Saml2LoginContext.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/authn/Saml2LoginContext.java
@@ -26,6 +26,7 @@ import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 
 import org.opensaml.Configuration;
+import org.opensaml.saml2.core.AuthnContext;
 import org.opensaml.saml2.core.AuthnContextClassRef;
 import org.opensaml.saml2.core.AuthnContextComparisonTypeEnumeration;
 import org.opensaml.saml2.core.AuthnContextDeclRef;
@@ -168,7 +169,7 @@ public class Saml2LoginContext extends LoginContext implements Serializable {
     /**
      * Extracts the authentication methods requested within the request.
      * 
-     * @return requested authentication methods
+     * @return requested authentication methods, or an empty list if no preference
      */
     protected List<String> extractRequestedAuthenticationMethods(){
         ArrayList<String> requestedMethods = new ArrayList<String>();
@@ -188,8 +189,6 @@ public class Saml2LoginContext extends LoginContext implements Serializable {
 
         // build a list of all requested authn classes and declrefs
         List<AuthnContextClassRef> authnClasses = authnContext.getAuthnContextClassRefs();
-        List<AuthnContextDeclRef> authnDeclRefs = authnContext.getAuthnContextDeclRefs();
-
         if (authnClasses != null) {
             for (AuthnContextClassRef classRef : authnClasses) {
                 if (classRef != null) {
@@ -198,6 +197,7 @@ public class Saml2LoginContext extends LoginContext implements Serializable {
             }
         }
 
+        List<AuthnContextDeclRef> authnDeclRefs = authnContext.getAuthnContextDeclRefs();
         if (authnDeclRefs != null) {
             for (AuthnContextDeclRef declRef : authnDeclRefs) {
                 if (declRef != null) {
@@ -205,6 +205,10 @@ public class Saml2LoginContext extends LoginContext implements Serializable {
                 }
             }
         }
+        
+        if(requestedMethods.contains(AuthnContext.UNSPECIFIED_AUTHN_CTX)){
+            requestedMethods.clear();
+        }
 
         return requestedMethods;
     }

diff --git a/src/edu/internet2/middleware/shibboleth/idp/authn/provider/PreviousSessionLoginHandler.java b/src/edu/internet2/middleware/shibboleth/idp/authn/provider/PreviousSessionLoginHandler.java
index 0c9b46c..5b05b9f 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/authn/provider/PreviousSessionLoginHandler.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/authn/provider/PreviousSessionLoginHandler.java
@@ -42,9 +42,6 @@ import edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine;
  */
 public class PreviousSessionLoginHandler extends AbstractLoginHandler {
 
-    /** PreviousSession authentication method URI. */
-    public static final String PREVIOUS_SESSION_AUTHN_METHOD = "urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession";
-
     /** Class logger. */
     private final Logger log = LoggerFactory.getLogger(PreviousSessionLoginHandler.class);