[java-identity-provider] branch master updated: IDP-868 - Stored persistent IDs can be invalidated by a future date

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=09b0495fe7c89f38dc3a87a8070e831dfd2b97fb

The following commit(s) were added to refs/heads/master by this push:
       new  09b0495   IDP-868 - Stored persistent IDs can be invalidated by a future date
09b0495 is described below

commit 09b0495fe7c89f38dc3a87a8070e831dfd2b97fb
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jul 16 08:43:19 2019 -0400

    IDP-868 - Stored persistent IDs can be invalidated by a future date
    
    https://issues.shibboleth.net/jira/browse/IDP-868
    
    Prevent the same problem when querying by persistent ID.
---
 .../idp/attribute/impl/JDBCPairwiseIdStore.java           | 10 +++++++---
 .../idp/attribute/impl/JDBCPairwiseIdStoreTest.java       | 15 ++++++++++++---
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStore.java b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStore.java
index 29f3969..c6de715 100644
--- a/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStore.java
+++ b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStore.java
@@ -480,8 +480,7 @@ public class JDBCPairwiseIdStore extends AbstractInitializableComponent implemen
         
         if (getByIssuedSelectSQL == null) {
             getByIssuedSelectSQL = "SELECT * FROM " + tableName + " WHERE " + issuerColumn + "= ? AND "
-                    + recipientColumn + "= ? AND " + persistentIdColumn + "= ? AND "
-                    + deactivationTimeColumn + " IS NULL";
+                    + recipientColumn + "= ? AND " + persistentIdColumn + "= ?";
         }
         
         if (getBySourceSelectSQL == null) {
@@ -654,7 +653,12 @@ public class JDBCPairwiseIdStore extends AbstractInitializableComponent implemen
             }
     
             if (entries.size() > 1) {
-                log.warn("More than one record found, only the first will be returned");
+                log.error("More than one record found for a single persistent ID value");
+            }
+            
+            if (entries.get(0).getDeactivationTime() != null &&
+                    !entries.get(0).getDeactivationTime().isAfter(Instant.now())) {
+                return null;
             }
     
             return entries.get(0);
diff --git a/idp-attribute-impl/src/test/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStoreTest.java b/idp-attribute-impl/src/test/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStoreTest.java
index b3f21df..e5fda95 100644
--- a/idp-attribute-impl/src/test/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStoreTest.java
+++ b/idp-attribute-impl/src/test/java/net/shibboleth/idp/attribute/impl/JDBCPairwiseIdStoreTest.java
@@ -22,6 +22,7 @@ import java.sql.Connection;
 import java.sql.SQLException;
 import java.time.Duration;
 import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.Objects;
 import java.util.UUID;
 
@@ -107,8 +108,7 @@ public class JDBCPairwiseIdStoreTest {
                 Objects.equals(one.getRecipientEntityID(), other.getRecipientEntityID()) &&
                 Objects.equals(one.getSourceSystemId(), other.getSourceSystemId()) &&
                 Objects.equals(one.getPrincipalName(), other.getPrincipalName()) &&
-                Objects.equals(one.getPeerProvidedId(), other.getPeerProvidedId()) &&
-                Objects.equals(one.getDeactivationTime(), other.getDeactivationTime());
+                Objects.equals(one.getPeerProvidedId(), other.getPeerProvidedId());
     }
    
     @Test public void storeEntry() throws ComponentInitializationException, IOException, SQLException {
@@ -141,7 +141,16 @@ public class JDBCPairwiseIdStoreTest {
         Assert.assertNull(id2.getDeactivationTime());
         Assert.assertTrue(comparePersistentIdEntrys(id2, id));
         
-        store.deactivate(id2);
+        id.setDeactivationTime(Instant.now().plus(1, ChronoUnit.HOURS));
+        store.deactivate(id);
+        
+        id2 = store.getByIssuedValue(id2);
+        
+        Assert.assertNotNull(id2.getDeactivationTime());
+        Assert.assertTrue(comparePersistentIdEntrys(id2, id));
+        
+        id.setDeactivationTime(null);
+        store.deactivate(id);
         
         Assert.assertNull(store.getByIssuedValue(id2));
      

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.