[java-identity-provider] branch main updated: IDP-1868 - Attribute-based subject c14n is mishandling Scoped values

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=05c84b956c9da60207385b194d0c531ac93a81b7

The following commit(s) were added to refs/heads/main by this push:
     new 05c84b956 IDP-1868 - Attribute-based subject c14n is mishandling Scoped values
05c84b956 is described below

commit 05c84b956c9da60207385b194d0c531ac93a81b7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 13 13:12:48 2021 -0400

    IDP-1868 - Attribute-based subject c14n is mishandling Scoped values
    
    https://shibboleth.atlassian.net/browse/IDP-1868
---
 .../impl/AttributeSourcedSubjectCanonicalization.java   | 14 +++++++-------
 .../AttributeSourcedSubjectCanonicalizationTest.java    | 17 +++++++++++++++++
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java
index 7305440ab..f5168f7f5 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java
@@ -230,7 +230,13 @@ public class AttributeSourcedSubjectCanonicalization extends AbstractSubjectCano
     @Nullable private String findValue(@Nonnull final IdPAttribute attribute) {
         
         for (final IdPAttributeValue val : attribute.getValues()) {
-            if (val instanceof StringAttributeValue) {
+            if (val instanceof ScopedStringAttributeValue) {
+                final ScopedStringAttributeValue scoped = (ScopedStringAttributeValue) val;
+                final String withScope = scoped.getValue() + delimiter + scoped.getScope();
+                log.debug("{} Using attribute {} scoped value {} as input to transforms", getLogPrefix(),
+                        attribute.getId(), withScope);
+                return applyTransforms(withScope);
+            } else if (val instanceof StringAttributeValue) {
                 final StringAttributeValue stringVal = (StringAttributeValue) val;
                 if (stringVal.getValue() == null || stringVal.getValue().isEmpty()) {
                     log.debug("{} Ignoring null/empty string value", getLogPrefix());
@@ -239,12 +245,6 @@ public class AttributeSourcedSubjectCanonicalization extends AbstractSubjectCano
                 log.debug("{} Using attribute {} string value {} as input to transforms", getLogPrefix(),
                         attribute.getId(), stringVal.getValue());
                 return applyTransforms(stringVal.getValue());
-            } else if (val instanceof ScopedStringAttributeValue) {
-                final ScopedStringAttributeValue scoped = (ScopedStringAttributeValue) val;
-                final String withScope = scoped.getValue() + delimiter + scoped.getScope();
-                log.debug("{} Using attribute {} scoped value {} as input to transforms", getLogPrefix(),
-                        attribute.getId(), withScope);
-                return applyTransforms(withScope);
             } else {
                 log.warn("{} Unsupported attribute value type: {}", getLogPrefix(), val.getClass().getName());
             }
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalizationTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalizationTest.java
index df0663213..f83290aa2 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalizationTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalizationTest.java
@@ -28,6 +28,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.ScopedStringAttributeValue;
 import net.shibboleth.idp.attribute.StringAttributeValue;
 import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.authn.AuthnEventIds;
@@ -122,6 +123,22 @@ public class AttributeSourcedSubjectCanonicalizationTest extends BaseAuthenticat
         Assert.assertEquals(sc.getPrincipalName(), "foo");
     }
 
+    @Test public void testSubjectSourcedScopedSuccess() throws ComponentInitializationException {
+        action.setResolveFromSubject(true);
+        action.initialize();
+        
+        final IdPAttribute inputAttribute = new IdPAttribute("attr2");
+        inputAttribute.setValues(Collections.singletonList(new ScopedStringAttributeValue("foo", "scope")));
+        final SubjectCanonicalizationContext sc = prc.getSubcontext(SubjectCanonicalizationContext.class, true);
+        sc.setSubject(new Subject());
+        sc.getSubject().getPrincipals().add(new IdPAttributePrincipal(inputAttribute));
+
+        final Event event = action.execute(src);
+        
+        ActionTestingSupport.assertProceedEvent(event);
+        Assert.assertEquals(sc.getPrincipalName(), "foo at scope");
+    }
+    
     @Test public void testDualSubjectSourcedSuccess() throws ComponentInitializationException {
         action.setResolveFromSubject(true);
         action.initialize();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.