[java-idp-oidc] branch main updated: JOIDC-62 - Profile config for bypassing attribute resolution not honored

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=9c75ab605b0289bfe04d92275009140578afe76d

The following commit(s) were added to refs/heads/main by this push:
     new 9c75ab60 JOIDC-62 - Profile config for bypassing attribute resolution not honored
9c75ab60 is described below

commit 9c75ab605b0289bfe04d92275009140578afe76d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 10 10:42:04 2022 -0500

    JOIDC-62 - Profile config for bypassing attribute resolution not honored
    
    https://shibboleth.atlassian.net/browse/JOIDC-62
    
    Add to UserInfo flow.
---
 .../idp/flows/oidc/userinfo/userinfo-beans.xml          |  3 +++
 .../idp/flows/oidc/userinfo/userinfo-flow.xml           | 17 +++++++++++++++--
 .../shibboleth/idp/service/relying-party/postconfig.xml |  8 ++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index fc54a65b..86ecda28 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -12,6 +12,9 @@
 
     <bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidcui:OIDC.UserInfo}" />
 
+    <bean id="ResolveAttributesPredicate"
+        class="net.shibboleth.idp.profile.config.logic.ResolveAttributesPredicate" />
+
     <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
         <constructor-arg>
             <bean class="net.shibboleth.idp.plugin.oidc.op.decoding.impl.OIDCUserInfoRequestDecoder" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
index 829952cd..02f6dc5e 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
@@ -9,6 +9,7 @@
         <evaluate expression="FlowStartPopulateAuditContext" />
         <evaluate expression="InitializeOutboundMessageContext" />
         <evaluate expression="'proceed'" />
+        
         <transition on="proceed" to="DecodeMessage" />
     </action-state>
 
@@ -17,6 +18,7 @@
         <evaluate expression="ValidateAccessToken" />
         <evaluate expression="PostDecodePopulateAuditContext" />
         <evaluate expression="'proceed'" />
+        
         <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
         <transition on="proceed" to="DoMetadataLookup" />
     </action-state>
@@ -26,6 +28,7 @@
         <evaluate expression="SelectProfileConfiguration" />
         <evaluate expression="PostLookupPopulateAuditContext" />
         <evaluate expression="'proceed'" />
+        
         <transition on="proceed" to="OutboundContextsAndSecurityParameters" />
     </action-state>
 
@@ -37,20 +40,29 @@
         <evaluate expression="PopulateUserInfoResponseSignatureSigningParameters" />
         <evaluate expression="PopulateUserInfoResponseEncryptionParameters" />
         <evaluate expression="'proceed'" />
+        
         <transition on="proceed" to="PostInitialSetup" />
     </action-state>
 
     <action-state id="PostInitialSetup">
         <evaluate expression="InitializeSubjectContext" />
+        <evaluate expression="SetSubjectToResponseContext" />
         <evaluate expression="'proceed'" />
-        <transition on="proceed" to="AttributeResolution" />
+        
+        <transition on="proceed" to="CheckAttributeResolution" />
     </action-state>
 
+    <decision-state id="CheckAttributeResolution">
+        <if test="ResolveAttributesPredicate.test(opensamlProfileRequestContext)"
+            then="AttributeResolution"
+            else="DoConsentLookup" />
+    </decision-state>
+
     <action-state id="AttributeResolution">
-        <evaluate expression="SetSubjectToResponseContext" />
         <evaluate expression="ResolveAttributes" />
         <evaluate expression="FilterAttributes" />
         <evaluate expression="'proceed'" />
+        
         <transition on="proceed" to="DoConsentLookup" />
     </action-state>
     
@@ -61,6 +73,7 @@
         <evaluate expression="SignUserInfoResponse" />
         <evaluate expression="EncryptUserInfoResponse" />
         <evaluate expression="'proceed'" />
+        
         <transition on="proceed" to="BuildResponseMessage" />
     </action-state>
 
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 62274f3e..b52ed7a2 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -286,6 +286,14 @@
         <property name="issuerLookupStrategy">
             <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
         </property>
+        <property name="resolveAttributesPredicate">
+            <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="resolveAttributes" />
+                </constructor-arg>
+                <constructor-arg value="true" />
+            </bean>
+        </property>
         <property name="encryptionOptionalPredicate">
             <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
                 <constructor-arg>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.