Allow login handler to return an exception and allow that exception to propogate...

git-svn-id: https://subversion.switch.ch/svn/shibboleth/java-idp/branches/REL_2@2859 ab3bd59b-922f-494d-bb5f-6f0a3c29deca

diff --git a/doc/RELEASE-NOTES.txt b/doc/RELEASE-NOTES.txt
index 5b56d04..7acfeeb 100644 (file)
--- a/doc/RELEASE-NOTES.txt
+++ b/doc/RELEASE-NOTES.txt
@@ -3,7 +3,8 @@ Changes in Release 2.1.3
 [SIDP-247] - Log Exception in UP LoginHandler Servlet
 [SIDP-263] - Suggest adding defaultSigningCredentialRef to the AnonymousRelyingParty element in the default config
 [SIDP-261] - IPAddressLoginHandler addresses comparasion fails
-[SIDP-265] -  Distinguish requested AuthMethod and default AuthMethod
+[SIDP-265] - Distinguish requested AuthMethod and default AuthMethod
+[SIDP-271] - AuthenticationEngine doesn't correctly handle passive return from login servlet
 [SIDP-276] - Example RDB Connector, quote principal
 [SIDP-277] - Incorrect null check for request context in UsernamePasswordServlet
 [SIDP-279] - IdP should log NameID for auditing

diff --git a/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java b/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
index a84537a..ce37b8f 100644 (file)
--- a/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
+++ b/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationEngine.java
@@ -625,6 +625,11 @@ public class AuthenticationEngine extends HttpServlet {
                     .getAttemptedAuthnMethod(), errorMessage);
             throw new AuthenticationException(errorMessage);
         }
+        
+        AuthenticationException authnException = (AuthenticationException) httpRequest.getAttribute(LoginHandler.AUTHENTICATION_EXCEPTION_KEY);
+        if(authnException != null){
+            throw authnException;
+        }
 
         Subject subject = (Subject) httpRequest.getAttribute(LoginHandler.SUBJECT_KEY);
         Principal principal = (Principal) httpRequest.getAttribute(LoginHandler.PRINCIPAL_KEY);

diff --git a/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java b/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java
index fe95119..ae1a37f 100644 (file)
--- a/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java
+++ b/src/main/java/edu/internet2/middleware/shibboleth/idp/authn/LoginHandler.java
@@ -32,16 +32,16 @@ import javax.servlet.http.HttpServletResponse;
  * 
  * After a successful authentication has been completed the handler <strong>MUST</strong> either:
  * <ul>
- * <li>Bind a {@link javax.security.auth.Subject} to the attribute identified by {@link #SUBJECT_KEY} if one was
- * created during the authentication process. The principals, public, and private credentials from this subject will be
- * merged with those in the {@link javax.security.auth.Subject} within the
+ * <li>Bind a {@link javax.security.auth.Subject} to the attribute identified by {@link #SUBJECT_KEY} if one was created
+ * during the authentication process. The principals, public, and private credentials from this subject will be merged
+ * with those in the {@link javax.security.auth.Subject} within the
  * {@link edu.internet2.middleware.shibboleth.idp.session.Session}.</li>
- * <li>Bind a {@link java.security.Principal} for the user to the request attribute identified by
- * {@link #PRINCIPAL_KEY}. Such a {@link java.security.Principal} <strong>MUST</strong> implement
- * {@link java.io.Serializable}. This principal will be added to the {@link javax.security.auth.Subject} within the
+ * <li>Bind a {@link java.security.Principal} for the user to the request attribute identified by {@link #PRINCIPAL_KEY}
+ * . Such a {@link java.security.Principal} <strong>MUST</strong> implement {@link java.io.Serializable}. This principal
+ * will be added to the {@link javax.security.auth.Subject} within the
  * {@link edu.internet2.middleware.shibboleth.idp.session.Session}.</li>
- * <li>Bind a principal name string to the request attribute identified by {@link #PRINCIPAL_NAME_KEY}. In this case
- * the {@link AuthenticationEngine} will create a {@link java.security.Principal} object of type
+ * <li>Bind a principal name string to the request attribute identified by {@link #PRINCIPAL_NAME_KEY}. In this case the
+ * {@link AuthenticationEngine} will create a {@link java.security.Principal} object of type
  * {@link edu.internet2.middleware.shibboleth.idp.authn.UsernamePrincipal} and add that to the
  * {@link javax.security.auth.Subject} within the {@link edu.internet2.middleware.shibboleth.idp.session.Session}.</li>
  * </ul>
@@ -51,8 +51,10 @@ import javax.servlet.http.HttpServletResponse;
  * <li>Bind a URI string, representing the authentication method actually used, to a request attribute identified by
  * {@link #AUTHENTICATION_METHOD_KEY}. This may be used if a handler is capable of performing multiple types of
  * authentication.</li>
- * <li>bind an error message, if an error occurred during authentication to the request attribute identified by
+ * <li>Bind an error message, if an error occurred during authentication to the request attribute identified by
  * {@link LoginHandler#AUTHENTICATION_ERROR_KEY}.</li>
+ * <li>Bind a {@link AuthenticationException}, if an exception occurred during authentication to the request attribute
+ * identified by {@link LoginHandler#AUTHENTICATION_EXCEPTION_KEY}.</li>
  * </ul>
  * 
  * Finally, the handler must return control to the authentication engine by invoking
@@ -80,6 +82,9 @@ public interface LoginHandler {
     /** Request attribute to which an error message may be bound. */
     public static final String AUTHENTICATION_ERROR_KEY = "authnError";
 
+    /** Request attribute to which an {@link AuthenticationException} may be bound. */
+    public static final String AUTHENTICATION_EXCEPTION_KEY = "authnException";
+
     /**
      * Gets the list of authentication methods this handler supports.
      *