[java-plugin-shibd-saml] branch main updated: Wire in SAML consumer parameter validation.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=176b17927b447414b3614f10f0234733082bfaed

The following commit(s) were added to refs/heads/main by this push:
     new 176b179  Wire in SAML consumer parameter validation.
176b179 is described below

commit 176b17927b447414b3614f10f0234733082bfaed
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Apr 2 11:13:46 2025 -0400

    Wire in SAML consumer parameter validation.
---
 .../idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml          | 2 ++
 .../sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml      | 2 ++
 .../net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml   | 2 ++
 .../net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml       | 5 +++++
 .../net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml        | 1 +
 5 files changed, 12 insertions(+)

diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
index e32dbf6..a839710 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
@@ -7,6 +7,8 @@
                            http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
     default-init-method="initialize" default-destroy-method="destroy">
 
+    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact" />
+
     <bean id="DecodeMessage" class="net.shibboleth.sp.profile.impl.DecodeMessage" scope="prototype"
             p:messageType="org.opensaml.saml.saml2.core.Response">
         <constructor-arg>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml
index dc6b2fb..46ba2a5 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml
@@ -7,6 +7,8 @@
                            http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
     default-init-method="initialize" default-destroy-method="destroy">
 
+    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.Response" />
+
     <bean id="DecodeMessage" class="net.shibboleth.sp.profile.impl.DecodeMessage" scope="prototype"
             p:messageType="org.opensaml.saml.saml2.core.Response">
         <constructor-arg>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml
index 1f06fd8..b260c69 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml
@@ -7,6 +7,8 @@
                            http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
     default-init-method="initialize" default-destroy-method="destroy">
 
+    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.Response" />
+
     <bean id="DecodeMessage" class="net.shibboleth.sp.profile.impl.DecodeMessage" scope="prototype"
             p:messageType="org.opensaml.saml.saml2.core.Response">
         <constructor-arg>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index ad7b3ac..c330976 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -12,6 +12,11 @@
 
     <import resource="classpath:/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml" />
 
+    <bean id="ValidateHttpServletRequest" class="net.shibboleth.sp.profile.impl.ValidateHttpServletRequest" scope="prototype"
+        p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
+        p:validator="#{getObject('shibboleth.HttpServletRequestValidator') ?: null}"
+        p:checkDuringInit="false" />
+
     <bean id="InboundEntityIDLookup" parent="shibboleth.Functions.Compose">
         <constructor-arg name="g">
             <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLEntityIDFunction" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
index 06ea41b..88a0b5d 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
@@ -5,6 +5,7 @@
 
     <action-state id="DoProfileWork">
 <!--        <evaluate expression="PopulateMetricContext" />-->
+        <evaluate expression="ValidateHttpServletRequest" />
         <evaluate expression="DecodeMessage" />
 <!--        <evaluate expression="PostDecodePopulateAuditContext" />-->
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.