[JIRA] Created: (SIDP-562) SSO profile handlers don't check for missing session

[Scott Cantor (JIRA)]

SSO profile handlers don't check for missing session
----------------------------------------------------

                 Key: SIDP-562
                 URL: https://issues.shibboleth.net/jira/browse/SIDP-562
             Project: Shibboleth IdP 2 - Java
          Issue Type: Bug
      Security Level: Standard (Standard bug, may impact functionality but does not represent a security vulnerability )
          Components: SAML 1, SAML 2
    Affects Versions: 2.3.8, 2.3.7, 2.3.6, 2.3.5, 2.3.4, 2.3.3, 2.3.2, 2.3.1, 2.3.0
            Reporter: Scott Cantor
            Assignee: Scott Cantor
            Priority: Critical
             Fix For: 2.4.0


The SSO profile handlers rely on the IdP Session to populate the request context with the principal name to use for attribute resolution and so forth. If that session lookup comes back null, I think the handlers are issuing "null" identity assertions instead of failing.

Still not sure what "fail" should mean here, but certainly either a local error or a SAML failure status.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira