Handle SAML responses with multiple assertions.

diff --git a/services/common/src/main/java/org/collectionspace/services/common/security/SecurityConfig.java b/services/common/src/main/java/org/collectionspace/services/common/security/SecurityConfig.java
index d2858b44df3e293f0a663dcb2b05cec1b7dac982..c99c13a010ce5c370d0ff728e4a3ff12fd4442f9 100644 (file)
--- a/services/common/src/main/java/org/collectionspace/services/common/security/SecurityConfig.java
+++ b/services/common/src/main/java/org/collectionspace/services/common/security/SecurityConfig.java
@@ -558,20 +558,25 @@ public class SecurityConfig {
                                                        : null
                                        );
 
-                                       Assertion assertion = responseToken.getResponse().getAssertions().get(0);
-                                       List<String> candidateUsernames = SecurityUtils.findSamlAssertionCandidateUsernames(assertion, assertionProbes);
+                                       List<String> attemptedUsernames = new ArrayList<>();
 
-                                       for (String candidateUsername : candidateUsernames) {
-                                               try {
-                                                       CSpaceUser user = (CSpaceUser) userDetailsService.loadUserByUsername(candidateUsername);
+                                       for (Assertion assertion : responseToken.getResponse().getAssertions()) {
+                                               List<String> candidateUsernames = SecurityUtils.findSamlAssertionCandidateUsernames(assertion, assertionProbes);
 
-                                                       return new CSpaceSaml2Authentication(user, authentication);
-                                               }
-                                               catch(UsernameNotFoundException e) {
+                                               for (String candidateUsername : candidateUsernames) {
+                                                       try {
+                                                               CSpaceUser user = (CSpaceUser) userDetailsService.loadUserByUsername(candidateUsername);
+
+                                                               return new CSpaceSaml2Authentication(user, authentication);
+                                                       }
+                                                       catch(UsernameNotFoundException e) {
+                                                       }
                                                }
+
+                                               attemptedUsernames.addAll(candidateUsernames);
                                        }
 
-                                       String errorMessage = "No CollectionSpace account was found for " + StringUtils.join(candidateUsernames, " / ") + ".";
+                                       String errorMessage = "No CollectionSpace account was found for " + StringUtils.join(attemptedUsernames, " / ") + ".";
 
                                        throw(new UsernameNotFoundException(errorMessage));
                                }