[java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindi...

[noreply at shibboleth.net]

Author: scantor
Date: Sat Jul 18 22:19:08 2015
New Revision: 7642

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7642&view=rev
Log:
IDP-773 - skipEndpointValidationWhenSigned not working for signed redirects

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java?rev=7642&r1=7641&r2=7642&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java	Sat Jul 18 22:19:08 2015
@@ -143,8 +143,8 @@
     /** Is the relying party "verified" in SAML terms? */
     private boolean verified;
     
-    /** Whether to bypass endpoint validation when message is signed. */
-    private boolean skipValidationWhenSigned;
+    /** Whether to bypass endpoint validation because message is signed. */
+    private boolean skipValidationSinceSigned;
     
     /** Constructor. */
     public PopulateBindingAndEndpointContexts() {
@@ -312,6 +312,7 @@
         }
     }
     
+ // Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -336,8 +337,10 @@
                             ((SAMLArtifactAwareProfileConfiguration) profileConfiguration).getArtifactConfiguration();
                 }
                 if (profileConfiguration instanceof BrowserSSOProfileConfiguration) {
-                    skipValidationWhenSigned =
-                            ((BrowserSSOProfileConfiguration) profileConfiguration).skipEndpointValidationWhenSigned();
+                    skipValidationSinceSigned =
+                            ((BrowserSSOProfileConfiguration) profileConfiguration).skipEndpointValidationWhenSigned()
+                            && inboundMessage instanceof AuthnRequest
+                            && SAMLBindingSupport.isMessageSigned(profileRequestContext.getInboundMessageContext()); 
                 }
             }
         }
@@ -352,7 +355,6 @@
         return true;
     }
 
-// Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         
@@ -524,11 +526,9 @@
                 log.debug("{} Defaulting binding in \"unverified\" request to {}", getLogPrefix(), unverifiedBinding);
             }
             return new EndpointCriterion(endpoint, true);
-        } else if (skipValidationWhenSigned && inboundMessage instanceof AuthnRequest
-                && ((AuthnRequest) inboundMessage).isSigned()) {
-            return new EndpointCriterion(endpoint, true);
         } else {
-            return new EndpointCriterion(endpoint, false);
+            // Here we only skip endpoint validation if the skip flag has been set.
+            return new EndpointCriterion(endpoint, skipValidationSinceSigned);
         }
     }