[java-identity-provider] branch main updated: IDP-1908 - IdP mishandles "empty" RequestedPrincipalContext

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6a79a42aee6d7775b1f80c940fcbe7c9e5bd405c

The following commit(s) were added to refs/heads/main by this push:
     new 6a79a42ae IDP-1908 - IdP mishandles "empty" RequestedPrincipalContext
6a79a42ae is described below

commit 6a79a42aee6d7775b1f80c940fcbe7c9e5bd405c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 25 09:35:18 2022 -0500

    IDP-1908 - IdP mishandles "empty" RequestedPrincipalContext
    
    https://shibboleth.atlassian.net/browse/IDP-1908
---
 .../idp/authn/context/RequestedPrincipalContext.java        |  9 ++++++---
 .../shibboleth/idp/authn/impl/FinalizeAuthentication.java   |  2 +-
 .../idp/authn/impl/FinalizeAuthenticationTest.java          | 13 ++++++++++++-
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
index f9c61587b..e256d1acb 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
@@ -112,7 +112,7 @@ public final class RequestedPrincipalContext extends BaseContext {
      * 
      * @return comparison operator
      */
-    @Nonnull @NotEmpty public String getOperator() {
+    @Nullable @NotEmpty public String getOperator() {
         return operatorString;
     }
     
@@ -183,8 +183,11 @@ public final class RequestedPrincipalContext extends BaseContext {
      */
     @Nullable public PrincipalEvalPredicate getPredicate(@Nonnull final Principal principal) {
         
-        final PrincipalEvalPredicateFactory factory = evalRegistry.lookup(principal.getClass(), operatorString);
-        return factory != null ? factory.getPredicate(principal) : null;
+        if (operatorString != null) {
+            final PrincipalEvalPredicateFactory factory = evalRegistry.lookup(principal.getClass(), operatorString);
+            return factory != null ? factory.getPredicate(principal) : null;
+        }
+        return null;
     }
     
     /**
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
index 96e1f9e31..89fc53388 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
@@ -144,7 +144,7 @@ public class FinalizeAuthentication extends AbstractAuthenticationAction {
         // and the actual result produced may be a subset (and therefore could be an inadequate subset).
         final RequestedPrincipalContext requestedPrincipalCtx =
                 authenticationContext.getSubcontext(RequestedPrincipalContext.class);
-        if (requestedPrincipalCtx != null) {
+        if (requestedPrincipalCtx != null && requestedPrincipalCtx.getOperator() != null) {
             
             // If a matching principal is set, re-verify it. Normally this will work.
             final Principal match = requestedPrincipalCtx.getMatchingPrincipal();
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java
index 570d262d9..a715f36ea 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/FinalizeAuthenticationTest.java
@@ -146,13 +146,24 @@ public class FinalizeAuthenticationTest extends BaseAuthenticationContextTest {
         authCtx.setAuthenticationResult(active);
         prc.getSubcontext(SubjectCanonicalizationContext.class, true).setPrincipalName("foo");
         
-        final Event event = action.execute(src);
+        Event event = action.execute(src);
         
         ActionTestingSupport.assertProceedEvent(event);
         SubjectContext sc = prc.getSubcontext(SubjectContext.class);
         Assert.assertNotNull(sc);
         Assert.assertEquals(sc.getPrincipalName(), "foo");
         Assert.assertEquals(sc.getAuthenticationResults().size(), 1);
+        
+        prc.removeSubcontext(SubjectContext.class);
+        authCtx.getSubcontext(RequestedPrincipalContext.class, true);
+        
+        event = action.execute(src);
+        
+        ActionTestingSupport.assertProceedEvent(event);
+        sc = prc.getSubcontext(SubjectContext.class);
+        Assert.assertNotNull(sc);
+        Assert.assertEquals(sc.getPrincipalName(), "foo");
+        Assert.assertEquals(sc.getAuthenticationResults().size(), 1);
     }
 
     @Test public void testMultipleActive() {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.