[java-opensaml] branch main updated: IDP-1974 - Blocking unsigned requests via profile configuration

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=fa20ce6d23b0f0cf0170488d3c0b2132cedc2828

The following commit(s) were added to refs/heads/main by this push:
     new fa20ce6d2 IDP-1974 - Blocking unsigned requests via profile configuration
fa20ce6d2 is described below

commit fa20ce6d23b0f0cf0170488d3c0b2132cedc2828
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Aug 22 12:01:58 2022 -0400

    IDP-1974 - Blocking unsigned requests via profile configuration
    
    https://shibboleth.atlassian.net/browse/IDP-1974
    
    Add subclassing hook for policy check.
---
 .../SAML2AuthnRequestsSignedSecurityHandler.java   | 62 ++++++++++++++--------
 1 file changed, 39 insertions(+), 23 deletions(-)

diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java
index 59fb2d4e3..12769a035 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java
@@ -41,7 +41,6 @@ public class SAML2AuthnRequestsSignedSecurityHandler extends AbstractMessageHand
     /** Logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(SAML2AuthnRequestsSignedSecurityHandler.class);
 
-// Checkstyle: ReturnCount OFF
     /** {@inheritDoc} */
     public void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
         final Object samlMessage = messageContext.getMessage();
@@ -50,10 +49,41 @@ public class SAML2AuthnRequestsSignedSecurityHandler extends AbstractMessageHand
             return;
         }
         
+        if (isRequestSigningRequired(messageContext)) {
+            if (!isMessageSigned(messageContext)) {
+                log.warn("Inbound AuthnRequest message was not signed");
+                throw new MessageHandlerException("Inbound AuthnRequest was required to be signed but was not");
+            }
+        }
+
+    }
+    
+    /**
+     * Determine whether the inbound message is signed.
+     * 
+     * @param messageContext the message context being evaluated
+     * @return true if the inbound message is signed, otherwise false
+     */
+    protected boolean isMessageSigned(@Nonnull final MessageContext messageContext) {
+        return SAMLBindingSupport.isMessageSigned(messageContext);
+    }
+
+    
+    /**
+     * Determine whether a signature is required.
+     * 
+     * @param messageContext message context
+     * 
+     * @return true iff the request must be signed
+     * 
+     * @since 4.3.0
+     */
+    protected boolean isRequestSigningRequired(@Nonnull final MessageContext messageContext) {
+        
         final SAMLPeerEntityContext peerContext = messageContext.getSubcontext(SAMLPeerEntityContext.class, true);
         if (peerContext == null || Strings.isNullOrEmpty(peerContext.getEntityId())) {
             log.warn("SAML peer entityID was not available, unable to evaluate rule");
-            return;
+            return false;
         }
         final String messageIssuer = peerContext.getEntityId();
         
@@ -61,38 +91,24 @@ public class SAML2AuthnRequestsSignedSecurityHandler extends AbstractMessageHand
         if (metadataContext == null || metadataContext.getRoleDescriptor() == null) {
             log.warn("SAMLPeerContext did not contain either a SAMLMetadataContext or a RoleDescriptor, " 
                     + "unable to evaluate rule");
-            return;
+            return false;
         }
         
         if (!(metadataContext.getRoleDescriptor() instanceof SPSSODescriptor)) {
             log.warn("RoleDescriptor was not an SPSSODescriptor, it was a {}. Unable to evaluate rule", 
                     metadataContext.getRoleDescriptor().getClass().getName());
-            return;
+            return false;
         }
         
         final SPSSODescriptor spssoRole = (SPSSODescriptor) metadataContext.getRoleDescriptor();
         
         if (spssoRole.isAuthnRequestsSigned() == Boolean.TRUE) {
-            if (!isMessageSigned(messageContext)) {
-                log.error("SPSSODescriptor for entity ID '{}' indicates AuthnRequests must be signed, "
-                        + "but inbound message was not signed", messageIssuer);
-                throw new MessageHandlerException("Inbound AuthnRequest was required to be signed but was not");
-            }
-        } else {
-            log.debug("SPSSODescriptor for entity ID '{}' does not require AuthnRequests to be signed", messageIssuer);
+            log.debug("SPSSODescriptor for entity ID '{}' indicates AuthnRequests must be signed", messageIssuer);
+            return true;
         }
-
-    }
-// Checkstyle: ReturnCount ON
-    
-    /**
-     * Determine whether the inbound message is signed.
-     * 
-     * @param messageContext the message context being evaluated
-     * @return true if the inbound message is signed, otherwise false
-     */
-    protected boolean isMessageSigned(@Nonnull final MessageContext messageContext) {
-        return SAMLBindingSupport.isMessageSigned(messageContext);
+        
+        log.debug("SPSSODescriptor for entity ID '{}' does not require AuthnRequests to be signed", messageIssuer);
+        return false;
     }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.