[java-identity-provider] branch main updated: IDP-2375 - Aliased decoded IdPAttributes are lost during subsequent use

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=52eb1d3b63bb8bbbb6cf5b05c071096f28ab7c04

The following commit(s) were added to refs/heads/main by this push:
     new 52eb1d3b6 IDP-2375 - Aliased decoded IdPAttributes are lost during subsequent use
52eb1d3b6 is described below

commit 52eb1d3b63bb8bbbb6cf5b05c071096f28ab7c04
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 22 10:44:20 2025 -0400

    IDP-2375 - Aliased decoded IdPAttributes are lost during subsequent use
    
    https://shibboleth.atlassian.net/browse/IDP-2375
    
    Handle the merging of data between decoded and extracted attributes.
---
 .../profile/impl/ValidateSAMLAuthentication.java   | 39 +++++++++++++---------
 1 file changed, 23 insertions(+), 16 deletions(-)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index 0b3377d5a..2354ccb77 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -16,7 +16,6 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
 
 import java.security.Principal;
 import java.time.Instant;
-import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;
@@ -57,6 +56,7 @@ import com.google.common.collect.Multimap;
 
 import net.shibboleth.idp.attribute.AttributeDecodingException;
 import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeSupport;
 import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.attribute.filter.AttributeFilter;
 import net.shibboleth.idp.attribute.filter.AttributeFilterException;
@@ -271,25 +271,30 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         if (transcoderRegistry != null) {
             processAttributes(profileRequestContext);
         }
-        final Function<ProfileRequestContext,Collection<IdPAttribute>> aes = attributeExtractionStrategy;
-        AttributeContext ac = attributeContext;
         
+        final Function<ProfileRequestContext,Collection<IdPAttribute>> aes = attributeExtractionStrategy;
         if (aes != null) {
             log.debug("{} Applying custom extraction strategy function", getLogPrefix());
-            if (ac == null) {
-                final RelyingPartyContext rpcCtx = profileRequestContext.getSubcontext(RelyingPartyContext.class);
-                assert rpcCtx!= null;
-                ac = attributeContext = rpcCtx.ensureSubcontext(AttributeContext.class);
-            }
-            final Collection<IdPAttribute> attributes = new ArrayList<>(ac.getIdPAttributes().values());
             final Collection<IdPAttribute> newAttributes = aes.apply(profileRequestContext);
             if (newAttributes != null) {
                 if (log.isDebugEnabled()) {
                     log.debug("{} Extracted attributes with custom strategy: {}", getLogPrefix(),
                             newAttributes.stream().map(IdPAttribute::getId).collect(Collectors.toUnmodifiableList()));
                 }
-                attributes.addAll(newAttributes);
-                ac.setIdPAttributes(attributes);
+
+                if (attributeContext != null) {
+                    // Need to merge the new collection with the original map.
+                    final Map<String,IdPAttribute> newMap = IdPAttributeSupport.toMapMergeDuplicates(newAttributes);
+                    assert attributeContext != null;
+                    attributeContext.setIdPAttributes(
+                            IdPAttributeSupport.withMapMergeDuplicates(newMap, attributeContext.getIdPAttributes()));
+                } else {
+                    // No existing attributes, so produce a merged map out of the custom extraction result
+                    // and store to new context.
+                    attributeContext = profileRequestContext.ensureSubcontext(RelyingPartyContext.class)
+                            .ensureSubcontext(AttributeContext.class);
+                    attributeContext.setIdPAttributes(IdPAttributeSupport.toMapMergeDuplicates(newAttributes));
+                }
             }
         }
 
@@ -514,9 +519,11 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         if (!mapped.isEmpty()) {
             final RelyingPartyContext rpCtx = profileRequestContext.getSubcontext(RelyingPartyContext.class);
             assert rpCtx != null;
-            final AttributeContext ac = attributeContext = rpCtx.ensureSubcontext(AttributeContext.class);
-            ac.setUnfilteredIdPAttributes(mapped.values());
-            ac.setIdPAttributes((Map<String, IdPAttribute>)null);
+            attributeContext = rpCtx.ensureSubcontext(AttributeContext.class);
+            // Merge any duplicates produced by the decoding step.
+            attributeContext
+                .setUnfilteredIdPAttributes(IdPAttributeSupport.toMapMergeDuplicates(mapped.values()))
+                .setIdPAttributes((Map<String, IdPAttribute>) null);
             filterAttributes(profileRequestContext);
         }
     }
@@ -573,7 +580,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
             filter.filterAttributes(filterContext);
             filterContext.removeFromParent();
             assert attributeContext!=null;
-            attributeContext.setIdPAttributes(filterContext.getFilteredIdPAttributes().values());
+            attributeContext.setIdPAttributes(filterContext.getFilteredIdPAttributes());
         } catch (final AttributeFilterException e) {
             log.error("{} Error while filtering inbound attributes", getLogPrefix(), e);
         } catch (final ServiceException e) {
@@ -593,7 +600,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         assert ac != null;
         
         filterContext.setDirection(Direction.INBOUND)
-            .setPrefilteredIdPAttributes(ac.getUnfilteredIdPAttributes().values())
+            .setPrefilteredIdPAttributes(ac.getUnfilteredIdPAttributes())
             .setMetadataResolver(metadataResolver)
             .setRequesterMetadataContextLookupStrategy(null)
             .setIssuerMetadataContextLookupStrategy(

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.