[java-identity-provider] branch main updated: OSJ-430 - Make InResponseTo validation optional

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=923e0f5c3e6884690ed8f0b68eb54a04b1fba801

The following commit(s) were added to refs/heads/main by this push:
     new 923e0f5c3 OSJ-430 - Make InResponseTo validation optional
923e0f5c3 is described below

commit 923e0f5c3e6884690ed8f0b68eb54a04b1fba801
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 3 15:51:32 2025 -0400

    OSJ-430 - Make InResponseTo validation optional
    
    https://shibboleth.atlassian.net/browse/OSJ-430
    
    Implement checkInResponseTo and wire into config and SAML proxy flow.
---
 .../shibboleth/idp/conf/relying-party-mddriven.xml |  8 ++++++
 .../idp/flows/authn/saml-authn-beans.xml           |  7 +++++
 .../impl/BrowserSSOProfileConfiguration.java       | 33 ++++++++++++++++++++++
 3 files changed, 48 insertions(+)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index 4d381bec1..bca776910 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -463,6 +463,14 @@
                 <constructor-arg value="true" />
             </bean>
         </property>
+        <property name="checkInResponseToPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="checkInResponseTo" />
+                </constructor-arg>
+                <constructor-arg value="true" />
+            </bean>
+        </property>
         <property name="skipEndpointValidationWhenSignedPredicate">
             <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
                 <constructor-arg>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index e0d63aeff..761628e8f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -384,6 +384,13 @@
         <property name="checkAddress">
             <bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckAddressPredicate" />
         </property>
+        <property name="inResponseToIgnored">
+            <bean parent="shibboleth.Conditions.NOT">
+                <constructor-arg>
+                    <bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckInResponseToPredicate" />
+                </constructor-arg>
+            </bean>
+        </property>
         <property name="maximumTimeSinceAuthn">
             <bean class="net.shibboleth.saml.saml2.profile.config.navigate.MaximumTimeSinceAuthnLookupFunction" />
         </property>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
index a737e8f53..699ba5cea 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
@@ -74,6 +74,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     /** Whether to compare client and assertion addresses on inbound SSO. */
     @Nonnull private Predicate<ProfileRequestContext> checkAddressPredicate;
 
+    /** Whether to validate inbound InResponseTo values. */
+    @Nonnull private Predicate<ProfileRequestContext> checkInResponseToPredicate;
+
     /** Whether the response endpoint should be validated if the request is signed. */
     @Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate;
 
@@ -167,6 +170,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
         ignoreScoping = PredicateSupport.alwaysFalse();
         forceAuthnPredicate = new ProxyAwareForceAuthnPredicate();
         checkAddressPredicate = PredicateSupport.alwaysTrue();
+        checkInResponseToPredicate = PredicateSupport.alwaysTrue();
         skipEndpointValidationWhenSignedPredicate = PredicateSupport.alwaysFalse();
         randomizeFriendlyNamePredicate = PredicateSupport.alwaysFalse();
         proxyCountLookupStrategy = FunctionSupport.constant(null);
@@ -349,6 +353,35 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
         checkAddressPredicate = Constraint.isNotNull(condition, "Address checking predicate cannot be null");
     }
     
+    /** {@inheritDoc} */
+    public boolean isCheckInResponseTo(@Nullable final ProfileRequestContext profileRequestContext) {
+        return checkInResponseToPredicate.test(profileRequestContext);
+    }
+    
+    /**
+     * Set whether the inbound InResponseTo value should be checked against the outgoing request message
+     * during inbound SSO.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 5.2.0
+     */
+    public void setCheckInResponseTo(final boolean flag) {
+        checkInResponseToPredicate = PredicateSupport.constant(flag);
+    }
+
+    /**
+     * Set a condition to determine whether the inbound InResponseTo value should be checked against the outgoing
+     * request message during inbound SSO.
+     * 
+     * @param condition condition to set
+     * 
+     * @since 5.2.0
+     */
+    public void setCheckInResponseToPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        checkInResponseToPredicate = Constraint.isNotNull(condition, "InResponseTo checking predicate cannot be null");
+    }
+
     /** {@inheritDoc} */
     public boolean isSkipEndpointValidationWhenSigned(@Nullable final ProfileRequestContext profileRequestContext) {
         return skipEndpointValidationWhenSignedPredicate.test(profileRequestContext);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.