diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java index 029729eb6bf..5c1951a686e 100644 --- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java +++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java @@ -281,9 +281,16 @@ public SessionId resetToStep(SessionId session, int resetToStep) { currentStep = StringHelper.toInteger(sessionAttributes.get(io.jans.as.model.config.Constants.AUTH_STEP), currentStep); } - for (int i = resetToStep; i <= currentStep; i++) { - String key = String.format("auth_step_passed_%d", i); - sessionAttributes.remove(key); + if (resetToStep <= currentStep) { + for (int i = resetToStep; i <= currentStep; i++) { + String key = String.format("auth_step_passed_%d", i); + sessionAttributes.remove(key); + } + } else { + // Scenario when we sckip steps. In this case we need to mark all previous steps as passed + for (int i = currentStep + 1; i < resetToStep; i++) { + sessionAttributes.put(String.format("auth_step_passed_%d", i), Boolean.TRUE.toString()); + } } sessionAttributes.put(io.jans.as.model.config.Constants.AUTH_STEP, String.valueOf(resetToStep));