[java-identity-provider] branch main updated: IDP-2177 - Check for message type early during decode process

Scott Cantor cantor.2 at osu.edu
Wed Dec 6 19:50:26 UTC 2023 

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6c5e418843d2fb674ead493566d5e5c2ba193056

The following commit(s) were added to refs/heads/main by this push:
     new 6c5e41884 IDP-2177 - Check for message type early during decode process
6c5e41884 is described below

commit 6c5e418843d2fb674ead493566d5e5c2ba193056
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 6 14:50:00 2023 -0500

    IDP-2177 - Check for message type early during decode process
    
    https://shibboleth.atlassian.net/browse/IDP-2177
    
    Wire in expected message type in DecodeMessage actions.
---
 .../net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml  | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml      | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml  | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml      | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml         | 3 ++-
 .../resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml   | 3 ++-
 .../resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml   | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml  | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml         | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml         | 3 ++-
 .../resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml    | 3 ++-
 .../resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml   | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml  | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml         | 3 ++-
 .../net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml      | 3 ++-
 15 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
index 419c447f3..3136e6718 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
@@ -23,7 +23,8 @@
         p:profileId="#{T(net.shibboleth.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration).PROFILE_ID}"
         p:loggingId="%{idp.service.logging.saml1artifact:ArtifactResolution}" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml1.core.Request">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml1.binding.decoding.impl.HTTPSOAP11Decoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
index 3b7ef854d..509414a35 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
@@ -24,7 +24,8 @@
         p:profileId="#{T(net.shibboleth.saml.saml1.profile.config.AttributeQueryProfileConfiguration).PROFILE_ID}"
         p:loggingId="%{idp.service.logging.saml1attrquery:AttributeQuery}" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml1.core.Request">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml1.binding.decoding.impl.HTTPSOAP11Decoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
index 8aa8900ac..e0de09fb7 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
@@ -23,7 +23,8 @@
         p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration).PROFILE_ID}"
         p:loggingId="%{idp.service.logging.saml2artifact:ArtifactResolution}" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.ArtifactResolve">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPSOAP11Decoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
index 5e98e60fc..bf57e5366 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
@@ -23,7 +23,8 @@
         p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.AttributeQueryProfileConfiguration).PROFILE_ID}"
         p:loggingId="%{idp.service.logging.saml2attrquery:AttributeQuery}" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.AttributeQuery">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPSOAP11Decoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml
index eeba4d300..0a6d249d0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml
@@ -11,7 +11,8 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPArtifactDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
index f74c759d9..a5199294f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
@@ -27,7 +27,8 @@
         p:browserProfile="false"
         p:loggingId="%{idp.service.logging.saml2slo:Logout}" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPSOAP11Decoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
index 69b93c659..0e7ce5112 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
@@ -11,7 +11,8 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
index 787f31b49..6da317450 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
@@ -11,7 +11,8 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostSimpleSignDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
index 6115e6b51..fb50f207a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
@@ -11,7 +11,8 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
         
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml
index c97b5d547..def944bbd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml
@@ -20,7 +20,8 @@
         p:loggingId="%{idp.service.logging.saml2sso:SSO}"
         p:browserProfile="true" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPArtifactDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml
index 8c94eb88c..5703d4350 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml
@@ -20,7 +20,8 @@
     <util:constant id="shibboleth.metrics.ProfileCounter"
         static-field="net.shibboleth.idp.saml.saml2.profile.config.impl.ECPProfileConfiguration.PROFILE_COUNTER" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPSOAP11Decoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml
index a2eaeed21..dcb622f31 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml
@@ -21,7 +21,8 @@
         p:loggingId="%{idp.service.logging.saml2sso:SSO}"
         p:browserProfile="true" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml
index 270dafe55..144bb8592 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml
@@ -21,7 +21,8 @@
         p:loggingId="%{idp.service.logging.saml2sso:SSO}"
         p:browserProfile="true" />
 
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostSimpleSignDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml
index 83910589a..29af96337 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml
@@ -21,7 +21,8 @@
         p:loggingId="%{idp.service.logging.saml2sso:SSO}"
         p:browserProfile="true" />
         
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
         <constructor-arg>
             <bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder" scope="prototype"
                 p:parserPool-ref="shibboleth.ParserPool"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml
index b99764dd9..91f79f7d6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml
@@ -21,7 +21,8 @@
         p:loggingId="%{idp.service.logging.saml2sso:SSO}"
         p:browserProfile="true" />
         
-    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
+    <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
+            p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
         <constructor-arg>
             <bean class="net.shibboleth.idp.saml.saml2.profile.impl.IdPInitiatedSSORequestMessageDecoder" scope="prototype"
                 p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.

More information about the commits mailing list