[java-identity-provider] branch main updated: IDP-2317 - Validation of X.509 client certificate chain breaks

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=de91c013ad8a2679d86144dda0b61f7583ec5b67

The following commit(s) were added to refs/heads/main by this push:
     new de91c013a IDP-2317 - Validation of X.509 client certificate chain breaks
de91c013a is described below

commit de91c013ad8a2679d86144dda0b61f7583ec5b67
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Aug 22 12:49:13 2024 -0400

    IDP-2317 - Validation of X.509 client certificate chain breaks
    
    https://shibboleth.atlassian.net/browse/IDP-2317
---
 .../authn/impl/X509CertificateCredentialValidator.java    | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java
index 9a36bf3b9..da3951941 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java
@@ -16,6 +16,8 @@ package net.shibboleth.idp.authn.impl;
 
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collection;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
@@ -124,12 +126,13 @@ public class X509CertificateCredentialValidator extends AbstractCredentialValida
             try {
                 final BasicX509Credential cred = new BasicX509Credential((X509Certificate) cert);
                 if (!certContext.getIntermediates().isEmpty()) {
-                    cred.getEntityCertificateChain().add((X509Certificate) certContext.getCertificate());
-                    for (final Certificate extra : certContext.getIntermediates()) {
-                        if (extra instanceof X509Certificate) {
-                            cred.getEntityCertificateChain().add((X509Certificate) extra);
-                        }
-                    }
+                    final Collection<X509Certificate> chain = new ArrayList<>();
+                    chain.add((X509Certificate) cert);
+                    certContext.getIntermediates().stream()
+                        .filter(X509Certificate.class::isInstance)
+                        .map(X509Certificate.class::cast)
+                        .forEach(chain::add);
+                    cred.setEntityCertificateChain(chain);
                 }
                 assert trustEngine != null;
                 if (trustEngine.validate(cred, new CriteriaSet())) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.