Merge "Add option to enforce auth with IdP on session expiration"
diff --git a/README.md b/README.md
index f7df7d7..73927aa 100644
--- a/README.md
+++ b/README.md
@@ -145,6 +145,11 @@
Default is `86400`
+**saml.forceAuth**: (Optional) Whether to force authentication with the IdP, when
+the session in Gerrit expires.
+
+Default is `false`
+
**saml.displayNameAttr**: Gerrit will look for an attribute with this name in
the assertion to find a display name for the user. If the attribute is not
found, the NameId from the SAML assertion is used instead.
diff --git a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java
index 9d5d047..4bb32a2 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlClientProvider.java
@@ -67,6 +67,8 @@
}
}
+ samlClientConfig.setForceAuth(samlConfig.getForceAuthAttr());
+
samlClientConfig.setUseNameQualifier(samlConfig.useNameQualifier());
samlClientConfig.setMaximumAuthenticationLifetime(samlConfig.getMaxAuthLifetimeAttr());
diff --git a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java
index 96c591c..ca6c45e 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/saml/SamlConfig.java
@@ -38,6 +38,7 @@
private final String firstNameAttr;
private final String lastNameAttr;
private final int maxAuthLifetimeDefault = 24 * 60 * 60; // 24h;
+ private final boolean forceAuth;
private final boolean useNameQualifier;
private final String memberOfAttr;
@@ -54,6 +55,7 @@
userNameAttr = getStringWithDefault(cfg, "userNameAttr", "UserName");
emailAddressAttr = getStringWithDefault(cfg, "emailAddressAttr", "EmailAddress");
maxAuthLifetimeAttr = cfg.getInt("saml", "maxAuthLifetime", maxAuthLifetimeDefault);
+ forceAuth = cfg.getBoolean(SAML_SECTION, "forceAuth", false);
computedDisplayName = cfg.getBoolean(SAML_SECTION, "computedDisplayName", false);
firstNameAttr = getStringWithDefault(cfg, "firstNameAttr", "FirstName");
lastNameAttr = getStringWithDefault(cfg, "lastNameAttr", "LastName");
@@ -93,6 +95,10 @@
return maxAuthLifetimeAttr;
}
+ public boolean getForceAuthAttr() {
+ return forceAuth;
+ }
+
private static String getString(Config cfg, String name) {
return cfg.getString(SAML_SECTION, null, name);
}
