[java-idp-oidc] 02/03: Refactored the class to not store the resolved metadata in a class variable.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=d8ae30fe8125cb216b788c7b2a068b997d014a5e

commit d8ae30fe8125cb216b788c7b2a068b997d014a5e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Apr 6 16:01:19 2023 +0300

    Refactored the class to not store the resolved metadata in a class variable.
---
 .../impl/OIDCClientInfoCredentialValidator.java    | 46 +++++++++++-----------
 1 file changed, 22 insertions(+), 24 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/OIDCClientInfoCredentialValidator.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/OIDCClientInfoCredentialValidator.java
index 5ea5a6a9..e91e8a03 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/OIDCClientInfoCredentialValidator.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/OIDCClientInfoCredentialValidator.java
@@ -66,9 +66,6 @@ public class OIDCClientInfoCredentialValidator extends AbstractUsernamePasswordC
     /** Digester for SHA-1. */
     @NonnullAfterInit private StringDigester digester;
 
-    /** Client information. */
-    @Nullable private OIDCClientInformation clientInformation = null;
-
     /** Constructor. */
     public OIDCClientInfoCredentialValidator() {
         oidcMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class).compose(
@@ -108,26 +105,24 @@ public class OIDCClientInfoCredentialValidator extends AbstractUsernamePasswordC
             @Nullable final ErrorHandler errorHandler) throws Exception {
 
         final OIDCMetadataContext oidcMetadataContext = oidcMetadataContextLookupStrategy.apply(profileRequestContext);
-        if (oidcMetadataContext != null) {
-            clientInformation = oidcMetadataContext.getClientInformation();
-        }
         
-        if (clientInformation == null || clientInformation.getOIDCMetadata() == null) {
+        if (oidcMetadataContext == null || oidcMetadataContext.getClientInformation() == null 
+                || oidcMetadataContext.getClientInformation() == null) {
             log.debug("{} OIDC client metadata is missing", getLogPrefix());
             return null;
-        } else {
-            final ClientMetadata clientMetadata = clientInformation.getMetadata();
-            if (ClientAuthenticationMethod.NONE.equals(clientMetadata.getTokenEndpointAuthMethod())) {
-                log.debug("{} OIDC client metadata contains 'none' type for endpoint authentication");
-                final Subject subject = new Subject();
-                subject.getPrincipals().add(
-                        new UsernamePrincipal(applyTransforms(clientInformation.getID().getValue())));
-                return super.populateSubject(subject);
-            } else if (clientInformation.getSecret() == null) {
-                log.debug("{} OIDC client metadata for '{}' missing client secret", getLogPrefix(),
-                        clientInformation.getID());
-                return null;
-            }
+        }
+
+        final OIDCClientInformation clientInformation = oidcMetadataContext.getClientInformation();
+        final ClientMetadata clientMetadata = clientInformation.getMetadata();
+        if (ClientAuthenticationMethod.NONE.equals(clientMetadata.getTokenEndpointAuthMethod())) {
+            log.debug("{} OIDC client metadata contains 'none' type for endpoint authentication");
+            final Subject subject = new Subject();
+            subject.getPrincipals().add(new UsernamePrincipal(applyTransforms(clientInformation.getID().getValue())));
+            return super.populateSubject(subject);
+        } else if (clientInformation.getSecret() == null) {
+            log.debug("{} OIDC client metadata for '{}' missing client secret", getLogPrefix(),
+                    clientInformation.getID());
+            return null;
         }
 
         return super.doValidate(profileRequestContext, authenticationContext, warningHandler, errorHandler);
@@ -141,16 +136,19 @@ public class OIDCClientInfoCredentialValidator extends AbstractUsernamePasswordC
             @Nullable final WarningHandler warningHandler,
             @Nullable final ErrorHandler errorHandler) throws Exception {
 
+        final OIDCMetadataContext oidcMetadataContext = oidcMetadataContextLookupStrategy.apply(profileRequestContext);
+        final OIDCClientInformation clientInformation = oidcMetadataContext.getClientInformation();
+
         final String username = usernamePasswordContext.getTransformedUsername();
         log.debug("{} Attempting to authenticate effective client ID '{}' ", getLogPrefix(), username);
         
-        final Secret secret = clientInformation.getSecret();
-        if (secret.getValue().startsWith("{SHA2}")) {
-            if (secret.getValue().substring(6).equals(digester.apply(usernamePasswordContext.getPassword()))) {
+        final String secret = clientInformation.getSecret().getValue();
+        if (secret.startsWith("{SHA2}")) {
+            if (secret.substring(6).equals(digester.apply(usernamePasswordContext.getPassword()))) {
                 log.info("{} Login by '{}' succeeded", getLogPrefix(), username);
                 return populateSubject(new Subject(), usernamePasswordContext);
             }
-        } else if (clientInformation.getSecret().getValue().equals(usernamePasswordContext.getPassword())) {
+        } else if (secret.equals(usernamePasswordContext.getPassword())) {
             log.info("{} Login by '{}' succeeded", getLogPrefix(), username);
             return populateSubject(new Subject(), usernamePasswordContext);
         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.