package org.apereo.cas.web.flow;

import org.springframework.webflow.definition.registry.FlowDefinitionRegistry;
import org.springframework.webflow.engine.ActionState;
import org.springframework.webflow.engine.Flow;
import org.springframework.webflow.engine.builder.support.FlowBuilderServices;

/**
 * The {@link X509WebflowConfigurer} is responsible for
 * adjusting the CAS webflow context for x509 integration.
 *
 * @author Misagh Moayyed
 * @since 4.2
 */
public class X509WebflowConfigurer extends AbstractCasWebflowConfigurer {

    private static final String EVENT_ID_START_X509 = "startX509Authenticate";

    public X509WebflowConfigurer(final FlowBuilderServices flowBuilderServices, final FlowDefinitionRegistry loginFlowDefinitionRegistry) {
        super(flowBuilderServices, loginFlowDefinitionRegistry);
    }

    @Override
    protected void doInitialize() throws Exception {
        final Flow flow = getLoginFlow();
        if (flow != null) {
            final ActionState actionState = createActionState(flow, EVENT_ID_START_X509, createEvaluateAction("x509Check"));
            actionState.getTransitionSet().add(createTransition(CasWebflowConstants.TRANSITION_ID_SUCCESS,
                    CasWebflowConstants.TRANSITION_ID_SEND_TICKET_GRANTING_TICKET));
            actionState.getTransitionSet().add(createTransition(CasWebflowConstants.TRANSITION_ID_WARN,
                    CasWebflowConstants.TRANSITION_ID_WARN));
            actionState.getTransitionSet().add(createTransition(CasWebflowConstants.TRANSITION_ID_ERROR,
                    CasWebflowConstants.STATE_ID_VIEW_LOGIN_FORM));
            actionState.getExitActionList().add(createEvaluateAction("clearWebflowCredentialsAction"));
            registerMultifactorProvidersStateTransitionsIntoWebflow(actionState);

            final ActionState state = (ActionState) flow.getState(CasWebflowConstants.STATE_ID_INIT_LOGIN_FORM);
            createTransitionForState(state, CasWebflowConstants.TRANSITION_ID_SUCCESS, EVENT_ID_START_X509, true);
        }
    }
}

@@ -410,16 +410,998 @@
 tion.%0A *
+ %0A * Creates a flow that starts by trying to construct credentials using an X509 %0A * certificate found as request attribute with key javax.servlet.request.X509Certificate%0A * %7B@link X509CertificateCredentialsNonInteractiveAction%7D%0A * If the check of the certificate is valid, flow goes to sendTicketGrantingTicket.%0A * On error or authenticationFailure, the user is sent to the login page. %0A * The authenticationFailure outcome can happen when CAS got a valid certificate but %0A * couldn't find entry for the certificate in an attribute repository and %0A * falling back to principal from the certificate is turned off via:%0A * cas.authn.x509.principal.returnNull=true%0A * %0A * Credentials are cleared out at the end of the action in case the user%0A * is sent to the login page where the X509 credentials object will cause%0A * errors (e.g. no username property) %0A * %0A * The X509 action is added to the main login flow by overriding the success%0A * outcome of the initializeLoginForm action.%0A * 
 %0A * @aut
@@ -2593,24 +2593,215 @@
 GIN_FORM));%0A
+            actionState.getTransitionSet().add(createTransition(CasWebflowConstants.TRANSITION_ID_AUTHENTICATION_FAILURE,%0A                    CasWebflowConstants.STATE_ID_VIEW_LOGIN_FORM));%0A%0A
             

Handle authenticationFailure in x509 webflow (#2555)