[java-idp-oidc] branch main updated: JOIDC-220 - Outbound interceptor flows are not executed before error responses
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Aug 8 11:03:10 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=df2e9253c615f3e3a38b168dd86641d47f5bead7
The following commit(s) were added to refs/heads/main by this push:
new df2e9253 JOIDC-220 - Outbound interceptor flows are not executed before error responses
df2e9253 is described below
commit df2e9253c615f3e3a38b168dd86641d47f5bead7
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Aug 8 14:02:46 2024 +0300
JOIDC-220 - Outbound interceptor flows are not executed before error responses
https://shibboleth.atlassian.net/browse/JOIDC-220
- Included outbound interceptor flow call for error messages
- Refactored outbound interceptor flow to be run after response message has been built but before encoding
- Refactored end-session flow to inherit outbound interceptor flow states from the abstract oidc flow
---
.../oauth2/introspection/introspection-flow.xml | 2 +-
.../pushed-authorization-flow.xml | 2 +-
.../flows/oauth2/revocation/revocation-flow.xml | 2 +-
.../oidc-abstract-api-info-flow.xml | 4 ++--
.../oidc/abstract-api/oidc-abstract-api-flow.xml | 2 +-
.../idp/flows/oidc/abstract/oidc-abstract-flow.xml | 28 ++++++++++++----------
.../idp/flows/oidc/authorize/authorize-flow.xml | 6 ++---
.../flows/oidc/end-session/end-session-flow.xml | 19 +++------------
.../idp/flows/oidc/register/register-flow.xml | 2 +-
.../shibboleth/idp/flows/oidc/token/token-flow.xml | 4 ++--
.../idp/flows/oidc/userinfo/userinfo-flow.xml | 2 +-
11 files changed, 31 insertions(+), 42 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
index ec9ff53b..3aa8e59f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
@@ -30,7 +30,7 @@
<evaluate expression="ProcessTokenForIntrospection" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</action-state>
<bean-import resource="introspection-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml
index e941791d..e688874b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml
@@ -44,7 +44,7 @@
<evaluate expression="StoreDPoPProofKeyThumbprint" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</action-state>
<bean-import resource="pushed-authorization-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
index 3e0f6f0f..ad68687a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
@@ -33,7 +33,7 @@
<evaluate expression="RevokeToken" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</action-state>
<bean-import resource="revocation-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml
index 2081ae12..1f6bd85c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml
@@ -18,12 +18,12 @@
<decision-state id="CheckInboundInterceptContext">
<if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
- then="PopulateOutboundInterceptContext" else="DoInboundInterceptSubflow" />
+ then="BuildResponseMessage" else="DoInboundInterceptSubflow" />
</decision-state>
<subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
<input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</subflow-state>
<bean-import resource="classpath:/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml
index 4b5912a6..d6642c4c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml
@@ -40,7 +40,7 @@
</on-entry>
<evaluate expression="BuildErrorResponseFromEvent" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="CommitResponse" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext"/>
</action-state>
<bean-import resource="classpath:/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
index 7511f896..c453f19a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
@@ -13,31 +13,33 @@
<transition on="proceed" to="#{transitionTarget}" />
</action-state>
- <action-state id="PopulateOutboundInterceptContext">
- <evaluate expression="PopulateOutboundInterceptContext" />
+ <!-- Actions common to most OIDC profile flows. -->
+ <action-state id="BuildResponseMessage">
+ <evaluate expression="FormOutboundMessage" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="CheckOutboundInterceptContext" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
</action-state>
+ <action-state id="PopulateOutboundInterceptContext">
+ <evaluate expression="PopulateOutboundInterceptContext" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CheckOutboundInterceptContext" />
+ </action-state>
+
<decision-state id="CheckOutboundInterceptContext">
+ <on-entry>
+ <evaluate expression="PopulateOutboundInterceptContext" />
+ </on-entry>
<if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
- then="BuildResponseMessage" else="DoOutboundInterceptSubflow" />
+ then="CommitResponse" else="DoOutboundInterceptSubflow" />
</decision-state>
<subflow-state id="DoOutboundInterceptSubflow" subflow="intercept">
<input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="CommitResponse" />
<transition to="HandleError" />
</subflow-state>
-
- <!-- Actions common to most OIDC profile flows. -->
- <action-state id="BuildResponseMessage">
- <evaluate expression="FormOutboundMessage" />
- <evaluate expression="'proceed'" />
- <transition on="proceed" to="CommitResponse" />
- </action-state>
-
<!-- Passthrough state if an exception is thrown. -->
<action-state id="LogRuntimeException">
<on-entry>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
index bac794a1..4ffc9741 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
@@ -299,13 +299,13 @@
<evaluate expression="PopulateClientStorageSaveContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="ClientStorageSave" />
- <transition on="NoSaveNeeded" to="PopulateOutboundInterceptContext" />
+ <transition on="NoSaveNeeded" to="BuildResponseMessage" />
<transition to="HandleError" />
</action-state>
<subflow-state id="ClientStorageSave" subflow="client-storage/write">
<input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="PopulateOutboundInterceptContext"/>
+ <transition on="proceed" to="BuildResponseMessage"/>
<transition to="HandleError" />
</subflow-state>
@@ -343,7 +343,7 @@
</on-entry>
<if
test="opensamlProfileRequestContext.getOutboundMessageContext() != null && opensamlProfileRequestContext.ensureOutboundMessageContext().getMessage() != null"
- then="CommitResponse" else="ErrorView" />
+ then="PopulateOutboundInterceptContext" else="ErrorView" />
<exception-handler bean="RethrowingFlowExecutionExceptionHandler" />
</decision-state>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
index 67a8304e..5f0f5e8e 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
@@ -144,7 +144,7 @@
<evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
</on-render>
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
<transition on="local" to="DestroySessions">
<set name="flowScope.transitionAfterDestroy" value="'LogoutCompleteView'" />
</transition>
@@ -180,7 +180,7 @@
<evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
</on-render>
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</view-state>
<view-state id="LogoutCompleteView" view="logout-complete">
@@ -200,22 +200,9 @@
<evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
</on-entry>
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</view-state>
- <action-state id="PopulateOutboundInterceptContext">
- <evaluate expression="PopulateOutboundInterceptContext" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="CheckOutboundInterceptContext" />
- <transition to="HandleError" />
- </action-state>
-
- <decision-state id="CheckOutboundInterceptContext">
- <if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
- then="HandleOutboundMessage" else="DoOutboundInterceptSubflow" />
- </decision-state>
-
<subflow-state id="DoOutboundInterceptSubflow" subflow="intercept">
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="HandleOutboundMessage" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
index 6059ca08..637c5620 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
@@ -65,7 +65,7 @@
<evaluate expression="AddLogoutParametersToClientMetadata" />
<evaluate expression="AddRemainingClaimsToClientMetadata" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</action-state>
<action-state id="BuildResponseMessage">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
index 99d778bc..b899bb64 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
@@ -207,7 +207,7 @@
<decision-state id="ProducingIDToken">
<if test="IssueIDTokenCondition.test(opensamlProfileRequestContext)"
then="BuildIDToken"
- else="PopulateOutboundInterceptContext" />
+ else="BuildResponseMessage" />
</decision-state>
<action-state id="BuildIDToken">
@@ -225,7 +225,7 @@
<evaluate expression="EncryptIDToken" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</action-state>
<bean-import resource="token-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
index 8890f361..e7120437 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
@@ -91,7 +91,7 @@
<evaluate expression="EncryptUserInfoResponse" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ <transition on="proceed" to="BuildResponseMessage" />
</action-state>
<bean-import resource="userinfo-beans.xml" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list