Revision: 2274
Author: olavmrk
Date: Wed Apr 28 01:16:14 2010
Log: IdP: Proper support for ForceAuthn with old login handlers.
http://code.google.com/p/simplesamlphp/source/detail?r=2274
Modified:
/trunk/lib/SimpleSAML/IdP.php
/trunk/modules/core/www/idp/resumeauth.php
=======================================
--- /trunk/lib/SimpleSAML/IdP.php Mon Apr 26 01:59:58 2010
+++ /trunk/lib/SimpleSAML/IdP.php Wed Apr 28 01:16:14 2010
@@ -329,6 +329,7 @@
$auth = $this->config->getString('auth');
$authSource = SimpleSAML_Auth_Source::getById($auth);
if ($authSource === NULL) {
+ $session = SimpleSAML_Session::getInstance();
$config = SimpleSAML_Configuration::getInstance();
$authurl = '/' . $config->getBaseURL() . $auth;
@@ -336,6 +337,7 @@
'IsPassive' => isset($state['isPassive']) ? $state['isPassive'] :
FALSE,
'ForceAuthn' => isset($state['ForceAuthn']) ? $state['ForceAuthn'] :
FALSE,
'State' => $state,
+ 'core:prevSession' =>
$session->getAuthnInstant(),
);
if (isset($state['saml:RequestId'])) {
@@ -352,7 +354,6 @@
}
$authId = SimpleSAML_Utilities::generateID();
- $session = SimpleSAML_Session::getInstance();
$session->setAuthnRequest('saml2', $authId,
$authnRequest);
$relayState =
SimpleSAML_Module::getModuleURL('core/idp/resumeauth.php',
array('RequestID' => $authId));
=======================================
--- /trunk/modules/core/www/idp/resumeauth.php Wed Apr 28 01:16:04 2010
+++ /trunk/modules/core/www/idp/resumeauth.php Wed Apr 28 01:16:14 2010
@@ -10,5 +10,10 @@
if (!$requestcache) {
throw new Exception('Could not retrieve cached RequestID = ' . $authId);
}
+
+if ($requestcache['ForceAuthn'] && $requestcache['core:prevSession'] ===
$session->getAuthnInstant()) {
+ throw new Exception('ForceAuthn set, but timestamp not updated.');
+}
+
$state = $requestcache['State'];
SimpleSAML_IdP::postAuth($state);
--
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en.
