[java-idp-plugin-oidc-rp] branch main updated: Prevent claims construction inside the Request Object if not supported

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=4b923d01579e54264c8802e11bdd27d1bc06cade

The following commit(s) were added to refs/heads/main by this push:
     new 4b923d0  Prevent claims construction inside the Request Object if not supported
4b923d0 is described below

commit 4b923d01579e54264c8802e11bdd27d1bc06cade
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Dec 22 16:58:15 2022 +0000

    Prevent claims construction inside the Request Object if not supported
---
 .../idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java     | 11 ++++++-----
 .../oidc/rp/messaging/impl/AddRequestedClaimsHandler.java     |  6 ++++++
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
index 0c9ddeb..e18a555 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
@@ -241,11 +241,12 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
         setClaimIfPresent(requestObjectClaims, "max_age", authnRequest.getMaxAge()); 
         setClaimIfPresent(requestObjectClaims, "prompt", authnRequest.getPrompt()); 
         
-        // Build the ACRs if set before adding the 'claims' claim
-        AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(authnRequest);
-        
-        if (authnRequest.getRequestedClaims() != null) {
-            requestObjectClaims.setClaim("claims", authnRequest.getRequestedClaims());
+        if (authnRequest.providerSupportsClaimsParameter()) {
+            // Build the ACRs if set before adding the 'claims' claim
+            AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(authnRequest);
+            if (authnRequest.getRequestedClaims() != null) {
+                requestObjectClaims.setClaim("claims", authnRequest.getRequestedClaims());
+            }
         }     
         
         // Validate the request object
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
index 322f827..21dc7d8 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
@@ -37,6 +37,9 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
  * A message handler that adds requested claims to the under constructions authentication request.
  * 
  * <p>The claims are added from a customizable strategy/hook. No additional claims are provided by default.</p>
+ * 
+ * <p>Also records in the request whether the upstream OP supports the claims parameter, for later inspection by 
+ * downstream components that only access to the request e.g. an encoder.</p>
  */
 public class AddRequestedClaimsHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
     
@@ -68,6 +71,9 @@ public class AddRequestedClaimsHandler extends AbstractOIDCAuthenticationRequest
     @Override protected void doInvoke(@Nonnull final MessageContext messageContext) 
             throws MessageHandlerException {
         
+        // Stash whether the OP supports the claims parameter for later introspection
+        getAuthenticationRequest().setProviderSupportsClaimsParameter(getProviderMetadata().supportsClaimsParam());
+        
         if (!getProviderMetadata().supportsClaimsParam()) {
             log.trace("{} OpenID Provider does not support the 'claims' parameter", getLogPrefix());
             return;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.