[java-identity-provider] branch master updated: IDP-1302 - Logout flow resolving encryption keys too aggressively

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6da12ebbc65914b5143cb7850b411f2fdfb60694

The following commit(s) were added to refs/heads/master by this push:
       new  6da12eb   IDP-1302 - Logout flow resolving encryption keys too aggressively
6da12eb is described below

commit 6da12ebbc65914b5143cb7850b411f2fdfb60694
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Aug 29 16:20:40 2018 -0400

    IDP-1302 - Logout flow resolving encryption keys too aggressively
    
    https://issues.shibboleth.net/jira/browse/IDP-1302
---
 .../profile/impl/PopulateEncryptionParameters.java | 49 +++++++++-------------
 1 file changed, 20 insertions(+), 29 deletions(-)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
index 36dad74..8fb20d4 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
@@ -27,7 +27,6 @@ import javax.xml.namespace.QName;
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
 import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
 import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
@@ -48,6 +47,7 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.saml.saml2.profile.config.SAML2ProfileConfiguration;
+import net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -59,7 +59,6 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
 
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.MessageLookup;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -88,9 +87,6 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
 
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateEncryptionParameters.class);
-
-    /** Strategy used to locate the {@link AuthnRequest} to operate on, if any. */
-    @Nonnull private Function<ProfileRequestContext,AuthnRequest> requestLookupStrategy;
     
     /** Strategy used to look up a {@link RelyingPartyContext} for configuration options. */
     @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
@@ -130,10 +126,6 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
 
     /** Constructor. */
     public PopulateEncryptionParameters() {
-        
-        requestLookupStrategy =
-                Functions.compose(new MessageLookup<>(AuthnRequest.class), new InboundMessageContextLookup());
-        
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
         
         // Create context by default.
@@ -148,17 +140,6 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
     }
     
     /**
-     * Set the strategy used to locate the {@link AuthnRequest} to examine, if any.
-     * 
-     * @param strategy strategy used to locate the {@link AuthnRequest}
-     */
-    public void setRequestLookupStrategy(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
-        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
-        requestLookupStrategy = Constraint.isNotNull(strategy, "AuthnRequest lookup strategy cannot be null");
-    }
-    
-    /**
      * Set the strategy used to return the {@link RelyingPartyContext} for configuration options.
      * 
      * @param strategy lookup strategy
@@ -274,18 +255,28 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
             log.debug("{} Not a SAML 2 profile configuration, nothing to do", getLogPrefix());
             return false;
         }
+                
+        Object msg = null;
+        if (profileRequestContext.getInboundMessageContext() != null) {
+            msg = profileRequestContext.getInboundMessageContext().getMessage();
+        }
+        
+        if (msg instanceof AuthnRequest) {
+            final AuthnRequest request = (AuthnRequest) msg;
+            if (request.getNameIDPolicy() != null) {
+                final String requestedFormat = request.getNameIDPolicy().getFormat();
+                if (requestedFormat != null && NameID.ENCRYPTED.equals(requestedFormat)) {
+                    log.debug("{} Request asked for encrypted identifier, disregarding installed predicate");
+                    encryptIdentifiers = true;
+                }
+            }            
+        } else if (msg != null && rpContext.getProfileConfig() instanceof SingleLogoutProfileConfiguration) {
+            log.debug("{} Inbound logout message, nothing to do", getLogPrefix());
+            return false;
+        }
         
         final SAML2ProfileConfiguration profileConfiguration = (SAML2ProfileConfiguration) rpContext.getProfileConfig();
         
-        final AuthnRequest request = requestLookupStrategy.apply(profileRequestContext);
-        if (request != null && request.getNameIDPolicy() != null) {
-            final String requestedFormat = request.getNameIDPolicy().getFormat();
-            if (requestedFormat != null && NameID.ENCRYPTED.equals(requestedFormat)) {
-                log.debug("{} Request asked for encrypted identifier, disregarding installed predicate");
-                encryptIdentifiers = true;
-            }
-        }
-
         if (!encryptIdentifiers) {
             encryptIdentifiers = profileConfiguration.getEncryptNameIDs().apply(profileRequestContext);
             // Encryption can only be optional if the request didn't specify it above.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.