[java-identity-provider] branch main updated: IDP-1921 - Post-authn intercepts bypassed if attr resolution disabled

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=1f963f68057a8725ed4324841fc9870f9f507dd6

The following commit(s) were added to refs/heads/main by this push:
     new 1f963f680 IDP-1921 - Post-authn intercepts bypassed if attr resolution disabled
1f963f680 is described below

commit 1f963f68057a8725ed4324841fc9870f9f507dd6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 14 11:52:14 2022 -0400

    IDP-1921 - Post-authn intercepts bypassed if attr resolution disabled
    
    https://shibboleth.atlassian.net/browse/IDP-1921
---
 .../main/resources/net/shibboleth/idp/flows/cas/login-flow.xml    | 8 +++++++-
 .../net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml     | 8 +++++++-
 .../net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml     | 8 +++++++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-flow.xml
index 88e9f4df2..d6869b20d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-flow.xml
@@ -66,14 +66,20 @@
     <decision-state id="CheckResolveAttributes">
         <if test="LoginConfigLookup.apply(opensamlProfileRequestContext).isResolveAttributes(opensamlProfileRequestContext)"
             then="ResolveAttributes"
-            else="GrantServiceTicket" />
+            else="PopulatePostAuthnInterceptContext" />
     </decision-state>
 
     <action-state id="ResolveAttributes">
         <evaluate expression="ResolveAttributes" />
         <evaluate expression="FilterAttributes" />
+        <evaluate expression="'proceed'" />
+        <transition on="proceed" to="PopulatePostAuthnInterceptContext" />
+    </action-state>
+
+    <action-state id="PopulatePostAuthnInterceptContext">
         <evaluate expression="PopulatePostAuthnInterceptContext" />
         <evaluate expression="'proceed'" />
+        
         <transition on="proceed" to="CheckPostAuthnInterceptContext" />
     </action-state>
 
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml
index 6a4fc2b32..cc0c9b077 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml
@@ -44,12 +44,18 @@
     <decision-state id="ResolveAttributes">
         <if test="ResolveAttributesPredicate.test(opensamlProfileRequestContext)"
             then="AttributeResolution"
-            else="BuildResponse" />
+            else="PopulatePostAuthnInterceptContext" />
     </decision-state>
     
     <action-state id="AttributeResolution">
         <evaluate expression="ResolveAttributes" />
         <evaluate expression="FilterAttributes" />
+        <evaluate expression="'proceed'" />
+        
+        <transition on="proceed" to="PopulatePostAuthnInterceptContext" />
+    </action-state>
+
+    <action-state id="PopulatePostAuthnInterceptContext">
         <evaluate expression="PopulatePostAuthnInterceptContext" />
         <evaluate expression="'proceed'" />
         
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
index f321ab327..67e8d2b44 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
@@ -52,12 +52,18 @@
     <decision-state id="ResolveAttributes">
         <if test="ResolveAttributesPredicate.test(opensamlProfileRequestContext)"
             then="AttributeResolution"
-            else="BuildResponse" />
+            else="PopulatePostAuthnInterceptContext" />
     </decision-state>
     
     <action-state id="AttributeResolution">
         <evaluate expression="ResolveAttributes" />
         <evaluate expression="FilterAttributes" />
+        <evaluate expression="'proceed'" />
+        
+        <transition on="proceed" to="PopulatePostAuthnInterceptContext" />
+    </action-state>
+    
+    <action-state id="PopulatePostAuthnInterceptContext">
         <evaluate expression="PopulatePostAuthnInterceptContext" />
         <evaluate expression="'proceed'" />
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.