[java-identity-provider] branch main updated: IDP-1803 - Construction of Scoping in AuthnRequests is broken

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fc93526e06c33f5410aec286159635aaea8cbf00

The following commit(s) were added to refs/heads/main by this push:
       new  fc93526e0 IDP-1803 - Construction of Scoping in AuthnRequests is broken
fc93526e0 is described below

commit fc93526e06c33f5410aec286159635aaea8cbf00
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 22 10:18:35 2021 -0400

    IDP-1803 - Construction of Scoping in AuthnRequests is broken
    
    https://issues.shibboleth.net/jira/browse/IDP-1803
---
 .../saml/saml2/profile/impl/AddAuthnRequest.java   |  4 +-
 .../saml2/profile/impl/AddAuthnRequestTest.java    | 89 ++++++++++++++++++++++
 2 files changed, 92 insertions(+), 1 deletion(-)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
index 9fc7eb9ed..5b3535a9a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -362,7 +362,9 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
         final SAMLObjectBuilder<Scoping> scopingBuilder =
                 (SAMLObjectBuilder<Scoping>) bf.<Scoping>getBuilderOrThrow(Scoping.DEFAULT_ELEMENT_NAME);
         final Scoping scoping = scopingBuilder.buildObject();
-        scoping.setProxyCount(Integer.min(0, count - 1));
+        if (count != null) {
+            scoping.setProxyCount(Integer.max(0, count - 1));
+        }
         
         if (!idplist.isEmpty()) {
             final SAMLObjectBuilder<IDPList> idpListBuilder =
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
index ca21c6cb0..c357296cd 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
@@ -20,6 +20,8 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
 import static org.testng.Assert.*;
 
 import java.util.Arrays;
+import java.util.Set;
+import java.util.stream.Collectors;
 
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
@@ -48,9 +50,11 @@ import org.opensaml.saml.saml1.core.AuthenticationStatement;
 import org.opensaml.saml.saml2.core.AuthnContext;
 import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
 import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.IDPEntry;
 import org.opensaml.saml.saml2.core.NameIDPolicy;
 import org.opensaml.saml.saml2.core.NameIDType;
 import org.opensaml.saml.saml2.core.RequestedAuthnContext;
+import org.opensaml.saml.saml2.core.Scoping;
 import org.springframework.webflow.execution.Event;
 import org.springframework.webflow.execution.RequestContext;
 import org.testng.annotations.BeforeMethod;
@@ -65,6 +69,11 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
     private RelyingPartyContext rpc;
     private AddAuthnRequest action;
     
+    /**
+     * Set up test state.
+     * 
+     * @throws ComponentInitializationException
+     */
     @BeforeMethod public void setUp() throws ComponentInitializationException {
         rc = new RequestContextBuilder().buildRequestContext();
         prc1 = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
@@ -179,6 +188,86 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
         assertTrue(nid.getAllowCreate());
     }
 
+    /** Test with Scoping element but no count. */
+    @Test public void testScopingNoCount() {
+        ac.getProxiableAuthorities().add("foo");
+        ac.getProxiableAuthorities().add("bar");
+        
+        Event event = action.execute(rc);
+        ActionTestingSupport.assertProceedEvent(event);
+        
+        assertNotNull(prc2.getOutboundMessageContext().getMessage());
+        assertTrue(prc2.getOutboundMessageContext().getMessage() instanceof AuthnRequest);
+
+        final AuthnRequest request = (AuthnRequest) prc2.getOutboundMessageContext().getMessage();
+        final Scoping scoping = request.getScoping();
+        assertNotNull(scoping);
+        assertNull(scoping.getProxyCount());
+        assertNotNull(scoping.getIDPList());
+        
+        final Set<String> requestedAuthorities = scoping.getIDPList().getIDPEntrys()
+                .stream()
+                .map(IDPEntry::getProviderID)
+                .filter(id -> id != null)
+                .collect(Collectors.toUnmodifiableSet());
+        
+        assertEquals(requestedAuthorities, ac.getProxiableAuthorities());
+    }
+
+    /** Test with Scoping element and count of 1. */
+    @Test public void testScopingCount1() {
+
+        ac.setProxyCount(1);
+        
+        Event event = action.execute(rc);
+        ActionTestingSupport.assertProceedEvent(event);
+        
+        assertNotNull(prc2.getOutboundMessageContext().getMessage());
+        assertTrue(prc2.getOutboundMessageContext().getMessage() instanceof AuthnRequest);
+
+        final AuthnRequest request = (AuthnRequest) prc2.getOutboundMessageContext().getMessage();
+        final Scoping scoping = request.getScoping();
+        assertNotNull(scoping);
+        assertNull(scoping.getIDPList());
+        assertEquals(scoping.getProxyCount(), Integer.valueOf(0));
+    }
+
+    /** Test with Scoping element and count of 5. */
+    @Test public void testScopingCount5() {
+
+        ac.setProxyCount(5);
+        
+        Event event = action.execute(rc);
+        ActionTestingSupport.assertProceedEvent(event);
+        
+        assertNotNull(prc2.getOutboundMessageContext().getMessage());
+        assertTrue(prc2.getOutboundMessageContext().getMessage() instanceof AuthnRequest);
+
+        final AuthnRequest request = (AuthnRequest) prc2.getOutboundMessageContext().getMessage();
+        final Scoping scoping = request.getScoping();
+        assertNotNull(scoping);
+        assertNull(scoping.getIDPList());
+        assertEquals(scoping.getProxyCount(), Integer.valueOf(4));
+    }
+
+    /** Test with Scoping element and count of 0 (this shouldn't really happen). */
+    @Test public void testScopingCount0() {
+
+        ac.setProxyCount(0);
+        
+        Event event = action.execute(rc);
+        ActionTestingSupport.assertProceedEvent(event);
+        
+        assertNotNull(prc2.getOutboundMessageContext().getMessage());
+        assertTrue(prc2.getOutboundMessageContext().getMessage() instanceof AuthnRequest);
+
+        final AuthnRequest request = (AuthnRequest) prc2.getOutboundMessageContext().getMessage();
+        final Scoping scoping = request.getScoping();
+        assertNotNull(scoping);
+        assertNull(scoping.getIDPList());
+        assertEquals(scoping.getProxyCount(), Integer.valueOf(0));
+    }
+
     /** Test that the action works for RequestedAuthnContext. */
     @Test public void testAuthnContext() {
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.