[java-identity-provider] branch main updated: IDP-2305 - Add action to force consent when per-attribute is not enabled

[Tom Zeller]

This is an automated email from the git hooks/post-receive script.

tzeller pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=50ceac718b1bf9419b2d958f7d474fddcba2f51a

The following commit(s) were added to refs/heads/main by this push:
     new 50ceac718 IDP-2305 - Add action to force consent when per-attribute is not enabled
50ceac718 is described below

commit 50ceac718b1bf9419b2d958f7d474fddcba2f51a
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Tue Aug 27 16:56:07 2024 -0500

    IDP-2305 - Add action to force consent when per-attribute is not enabled
    
    Set consent approval to true for any consent not true - which is
    possible if extracted hidden fields are somehow removed.
    
    https://shibboleth.atlassian.net/browse/IDP-2305
---
 .../flows/intercept/attribute-release-beans.xml    |  4 ++
 .../idp/flows/intercept/attribute-release-flow.xml |  1 +
 .../flow/ar/impl/ValidatedExtractedConsent.java    | 62 ++++++++++++++++++++++
 3 files changed, 67 insertions(+)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
index 59e423eb4..94d27583d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
@@ -156,6 +156,10 @@
         class="net.shibboleth.idp.consent.flow.impl.ExtractConsent" scope="prototype"
         p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
 
+    <bean id="ValidatedExtractedConsent"
+        class="net.shibboleth.idp.consent.flow.ar.impl.ValidatedExtractedConsent" scope="prototype"
+        p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
+
     <bean id="CreateResult"
         class="net.shibboleth.idp.consent.flow.storage.impl.CreateResult" scope="prototype"
         p:storageKeyLookupStrategy-ref="shibboleth.consent.UserAndRelyingPartyStorageKey" 
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
index 0d9cd6ca0..a0d71f7f2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
@@ -196,6 +196,7 @@
 
     <action-state id="ExtractConsent">
         <evaluate expression="ExtractConsent" />
+        <evaluate expression="ValidatedExtractedConsent" />
         <evaluate expression="'AttributeReleaseConsent'" />
         
         <transition on="AttributeReleaseConsent" to="AttributeReleaseConsent" />
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/ar/impl/ValidatedExtractedConsent.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/ar/impl/ValidatedExtractedConsent.java
new file mode 100644
index 000000000..f3b6a7f88
--- /dev/null
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/ar/impl/ValidatedExtractedConsent.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.consent.flow.ar.impl;
+
+import java.util.Map;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.consent.Consent;
+import net.shibboleth.idp.consent.context.ConsentContext;
+import net.shibboleth.idp.profile.context.ProfileInterceptorContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+/**
+ * Consent action which validates extracted user input when per-attribute consent is not enabled.
+ * 
+ * If {@link Consent#isApproved()} is false, log a warning and set {@link Consent#isApproved()} to true.
+ * 
+ * When per-attribute consent is not enabled, every extracted consent should be true.
+ * 
+ * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * @event {@link org.opensaml.profile.action.EventIds#INVALID_PROFILE_CTX}
+ * @post See above.
+ */
+public class ValidatedExtractedConsent extends AbstractAttributeReleaseAction {
+
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ValidatedExtractedConsent.class);
+
+    /** {@inheritDoc} */
+    @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+            @Nonnull final ProfileInterceptorContext interceptorContext) {
+
+        if (!getAttributeReleaseFlowDescriptor().isPerAttributeConsentEnabled()) {
+            final ConsentContext consentContext = getConsentContext();
+            assert consentContext != null;
+            final Map<String, Consent> currentConsents = consentContext.getCurrentConsents();
+            for (final Consent consent : currentConsents.values()) {
+                if (!consent.isApproved()) {
+                    log.warn("{} Consent should have been approved for '{}'", getLogPrefix(), consent);
+                    consent.setApproved(Boolean.TRUE);
+                }
+            }
+            log.debug("{} Consent context '{}'", getLogPrefix(), consentContext);
+        }
+    }
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.