[JIRA] (JOIDC-86) Facilitate login_hint sanitization

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiYjJhNzc4MzA5ODcxNDgwOGIzM2VhNGJmMmYxZjEwZTMiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/JOIDC-86?atlOrigin=eyJpIjoiYjJhNzc4MzA5ODcxNDgwOGIzM2VhNGJmMmYxZjEwZTMiLCJwIjoiaiJ9 ) JOIDC-86 ( https://shibboleth.atlassian.net/browse/JOIDC-86?atlOrigin=eyJpIjoiYjJhNzc4MzA5ODcxNDgwOGIzM2VhNGJmMmYxZjEwZTMiLCJwIjoiaiJ9 ) Facilitate login_hint sanitization ( https://shibboleth.atlassian.net/browse/JOIDC-86?atlOrigin=eyJpIjoiYjJhNzc4MzA5ODcxNDgwOGIzM2VhNGJmMmYxZjEwZTMiLCJwIjoiaiJ9 )

Issue Type: New Feature Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Authorization Endpoint Created: 31/Mar/22 10:42 AM Fix Versions: 3.1.0 Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

The OIDC core specifies an optional login_hint parameter for the authentication request. If it exists, the OP plugin simply stores it into the authentication context via setHintedName -method. The hinted name is not wired anywhere by default, but some deployers may want to exploit it for instance as the default username on the login form. The login view already has a helper bean HTMLEncoder that can be used for defending script injections etc, but we should still offer an extension point for sanitising the login hint before it’s stored in the authentication context.

( https://shibboleth.atlassian.net/browse/JOIDC-86#add-comment?atlOrigin=eyJpIjoiYjJhNzc4MzA5ODcxNDgwOGIzM2VhNGJmMmYxZjEwZTMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-86#add-comment?atlOrigin=eyJpIjoiYjJhNzc4MzA5ODcxNDgwOGIzM2VhNGJmMmYxZjEwZTMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:666e164 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220331/8d955d83/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-a1fc6d78-50f7-4903-a9e2-51b4e972521b
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220331/8d955d83/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-b919553e-30a6-4b6c-823c-e9b07a0a7dca
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220331/8d955d83/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-9c3998b1-1ed6-4ad7-8146-be195cb93486
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220331/8d955d83/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-b966bf83-79f7-4521-8086-7b782eb860df
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220331/8d955d83/attachment-0007.png>