[java-opensaml] branch main updated: OSJ-348: SAML Assertion signature validation should evaluate ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=990a79516885076a8f226f2ff9b42be02bc7d179

The following commit(s) were added to refs/heads/main by this push:
     new 990a79516 OSJ-348: SAML Assertion signature validation should evaluate ...
990a79516 is described below

commit 990a79516885076a8f226f2ff9b42be02bc7d179
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Mar 2 18:36:20 2022 -0500

    OSJ-348: SAML Assertion signature validation should evaluate ...
    
    SAML Assertion signature validation should evaluate algorithm policy
---
 .../impl/DefaultAssertionValidationContextBuilder.java       | 12 ++++++++++++
 .../impl/DefaultSAML20AssertionValidationContextBuilder.java | 11 +++++++++++
 2 files changed, 23 insertions(+)

diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
index 825c897e0..aae79eccf 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
@@ -66,6 +66,7 @@ import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.messaging.ServletRequestX509CredentialAdapter;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.xmlsec.context.SecurityParametersContext;
+import org.opensaml.xmlsec.signature.support.SignatureValidationParametersCriterion;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -855,6 +856,7 @@ public class DefaultAssertionValidationContextBuilder
      * @param criteriaSet the criteria set to populate
      * @param inboundContext the inbound message context
      */
+    // Checkstyle: CyclomaticComplexity OFF
     protected void populateSignatureCriteriaFromInboundContext(@Nonnull final CriteriaSet criteriaSet,
             @Nonnull final MessageContext inboundContext) {
 
@@ -879,7 +881,17 @@ public class DefaultAssertionValidationContextBuilder
                 && protocolContext != null && protocolContext.getProtocol() != null) {
             criteriaSet.add(new ProtocolCriterion(protocolContext.getProtocol()));
         }
+        
+        if (!criteriaSet.contains(SignatureValidationParametersCriterion.class)) {
+            final SecurityParametersContext secParamsContext =
+                    inboundContext.getSubcontext(SecurityParametersContext.class);
+            if (secParamsContext != null && secParamsContext.getSignatureValidationParameters() != null) {
+                criteriaSet.add(new SignatureValidationParametersCriterion(
+                        secParamsContext.getSignatureValidationParameters()));
+            }
+        }
     }
+    // Checkstyle: CyclomaticComplexity ON
 
     /**
      * Get the attesting entity's {@link X509Certificate}.
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
index b1e080d53..72e02c59d 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
@@ -48,6 +48,8 @@ import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.messaging.ServletRequestX509CredentialAdapter;
 import org.opensaml.security.x509.X509Credential;
+import org.opensaml.xmlsec.context.SecurityParametersContext;
+import org.opensaml.xmlsec.signature.support.SignatureValidationParametersCriterion;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -217,6 +219,15 @@ public class DefaultSAML20AssertionValidationContextBuilder
             criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
         }
         
+        if (!criteriaSet.contains(SignatureValidationParametersCriterion.class)) {
+            final SecurityParametersContext secParamsContext =
+                    input.getMessageContext().getSubcontext(SecurityParametersContext.class);
+            if (secParamsContext != null && secParamsContext.getSignatureValidationParameters() != null) {
+                criteriaSet.add(new SignatureValidationParametersCriterion(
+                        secParamsContext.getSignatureValidationParameters()));
+            }
+        }
+        
         log.debug("Resolved Signature validation CriteriaSet: {}", criteriaSet);
         
         return criteriaSet;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.