[java-shib-profile] branch main updated: OSJ-430 - Make InResponseTo validation optional

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-profile.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-profile.git;a=commit;h=ed23ab111cd45629eb93b4ede99be28de49067e2

The following commit(s) were added to refs/heads/main by this push:
     new ed23ab1  OSJ-430 - Make InResponseTo validation optional
ed23ab1 is described below

commit ed23ab111cd45629eb93b4ede99be28de49067e2
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 3 15:50:36 2025 -0400

    OSJ-430 - Make InResponseTo validation optional
    
    https://shibboleth.atlassian.net/browse/OSJ-430
    
    Add a checkInResponseTo config option for SSO profile.
---
 .../ClientTLSArtifactRequestsPredicate.java        |  6 ++-
 .../config/BrowserSSOProfileConfiguration.java     | 14 +++++++
 .../config/logic/CheckInResponseToPredicate.java   | 48 ++++++++++++++++++++++
 3 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/messaging/ClientTLSArtifactRequestsPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/messaging/ClientTLSArtifactRequestsPredicate.java
index a929f67..1c892c8 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/messaging/ClientTLSArtifactRequestsPredicate.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/messaging/ClientTLSArtifactRequestsPredicate.java
@@ -22,8 +22,10 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.logic.messaging.AbstractRelyingPartyPredicate;
 import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
 
-/** A predicate implementation that forwards to 
- * {@link SAMLArtifactConsumerProfileConfiguration#isClientTLSArtifactRequests(MessageContext)}. */
+/**
+ * A predicate implementation that forwards to 
+ * {@link SAMLArtifactConsumerProfileConfiguration#isClientTLSArtifactRequests(MessageContext)}.
+ */
 public class ClientTLSArtifactRequestsPredicate extends AbstractRelyingPartyPredicate {
     
     /** {@inheritDoc} */
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 708de9d..586244b 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -31,6 +31,7 @@ import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
+import org.opensaml.saml.saml2.core.SubjectConfirmationData;
 import org.opensaml.saml.saml2.core.SubjectLocality;
 import org.opensaml.saml.saml2.metadata.RequestedAttribute;
 
@@ -82,6 +83,19 @@ public interface BrowserSSOProfileConfiguration extends AttributeResolvingProfil
      */
     @ConfigurationSetting(name="checkAddress")
     boolean isCheckAddress(@Nullable final ProfileRequestContext profileRequestContext);
+
+    /**
+     * Get whether the inbound {@link SubjectConfirmationData#getInResponseTo()} value
+     * should be enforced against the outbound request, if any.
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return whether to enforce InResponseTo comparison or presence
+     * 
+     * @since 5.2.0
+     */
+    @ConfigurationSetting(name="checkInResponseTo")
+    boolean isCheckInResponseTo(@Nullable final ProfileRequestContext profileRequestContext);
     
     /**
      * Get the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/CheckInResponseToPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/CheckInResponseToPredicate.java
new file mode 100644
index 0000000..39c3e95
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/CheckInResponseToPredicate.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A predicate that evaluates a {@link ProfileRequestContext} and extracts the effective
+ * setting of {@link BrowserSSOProfileConfiguration#isCheckInResponseTo(ProfileRequestContext)}.
+ * 
+ * <p>Defaults to true.</p>
+ * 
+ * @since 5.2.0
+ */
+public class CheckInResponseToPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        
+        final RelyingPartyContext rpc = getRelyingPartyContext(input);
+        if (rpc != null) {
+            if (rpc.getProfileConfig() instanceof BrowserSSOProfileConfiguration sso) {
+                return sso.isCheckInResponseTo(input);
+            }
+        }
+        
+        return true;
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.