[java-opensaml] branch main updated: OSJ-335: X.509 certificate access should include support for ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=b4993b34221773846a6912efa6ee0bbeaa46dd80

The following commit(s) were added to refs/heads/main by this push:
     new b4993b342 OSJ-335: X.509 certificate access should include support for ...
b4993b342 is described below

commit b4993b34221773846a6912efa6ee0bbeaa46dd80
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Mar 4 10:29:27 2022 -0500

    OSJ-335: X.509 certificate access should include support for ...
    
    X.509 certificate access should include support for jakarta attribute
---
 .../messaging/ServletRequestX509CredentialAdapter.java  | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
index 924642fc0..2cf39762c 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
@@ -40,6 +40,9 @@ public class ServletRequestX509CredentialAdapter extends AbstractCredential impl
     /** Servlet request attribute to pull certificate info from. */
     public static final String X509_CERT_REQUEST_ATTRIBUTE = "javax.servlet.request.X509Certificate";
     
+    /** Servlet request attribute to pull certificate info from. */
+    public static final String JAKARTA_X509_CERT_REQUEST_ATTRIBUTE = "jakarta.servlet.request.X509Certificate";
+    
     /** The entity certificate. */
     private X509Certificate cert;
     
@@ -55,10 +58,18 @@ public class ServletRequestX509CredentialAdapter extends AbstractCredential impl
      *  request attribute 'javax.servlet.request.X509Certificate'
      */
     public ServletRequestX509CredentialAdapter(final ServletRequest request) throws SecurityException {
-        final X509Certificate[] chain = (X509Certificate[]) request.getAttribute(X509_CERT_REQUEST_ATTRIBUTE);
+        X509Certificate[] chain = (X509Certificate[]) request.getAttribute(X509_CERT_REQUEST_ATTRIBUTE);
+        
+        if (chain == null || chain.length == 0) {
+            // Check for newer Jakarta variant.
+            // TODO: Once Jakarta is "common", probably reverse these checks.
+            chain = (X509Certificate[]) request.getAttribute(JAKARTA_X509_CERT_REQUEST_ATTRIBUTE);
+        }
+        
         if (chain == null || chain.length == 0) {
-            throw new SecurityException("Servlet request does not contain X.509 certificates in attribute "
-                    + X509_CERT_REQUEST_ATTRIBUTE);
+            throw new SecurityException(
+                    String.format("Servlet request does not contain X.509 certificates in either attribute %s or %s",
+                    X509_CERT_REQUEST_ATTRIBUTE, JAKARTA_X509_CERT_REQUEST_ATTRIBUTE));
         }
 
         cert = chain[0];

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.