[java-plugin-shibd-oidc] branch main updated: Improve token session data logic
Codeberg
noreply at shibboleth.net
Thu Dec 4 17:16:21 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/3520c7484f488c00b178ae3ac3e69ed15dc577cf
The following commit(s) were added to refs/heads/main by this push:
new 3520c74 Improve token session data logic
3520c74 is described below
commit 3520c7484f488c00b178ae3ac3e69ed15dc577cf
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Dec 4 17:16:09 2025 +0000
Improve token session data logic
---
.../sp/oidc/profile/impl/PrepareAgentResponse.java | 52 +++++++++++++---------
.../profile/impl/PrepareAgentResponseTest.java | 21 +--------
2 files changed, 34 insertions(+), 39 deletions(-)
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
index d7eaa50..a1f8ec6 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
@@ -49,7 +49,11 @@ import net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction;
* UserInfo endpoint. The access token is used if it is still valid; otherwise,
* the refresh token is used to obtain a new access token.</p>
*
- * TODO...
+ * <p>If a {@link DataSealer} is supplied, the tokens will be sealed before they are added to the session. Tokens are
+ * sensitive so a data sealer is strongly recommended.</p>
+ *
+ * <p>If the data sealer fails to seal a token, that token (and its associated data) will simply not be included in the
+ * session data.</p>
*/
public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
@@ -132,47 +136,55 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
final RefreshToken refreshToken = tokenResponse.getTokens().getRefreshToken();
log.debug("{} Storing access and refresh tokens in session data", getLogPrefix());
- final DDF tokens = new DDF(null).structure();
-
- boolean accessTokenAdded = false;
+ final DDF tokens = new DDF(null).structure();
+
final DataSealer localDataSealer = dataSealer;
+
+ // Add the refresh token if it exists
+ if (refreshToken != null) {
+ if (localDataSealer != null) {
+ try {
+ tokens.addmember("refresh_token").string(localDataSealer.wrap(refreshToken.getValue()));
+ } catch (final DataSealerException e) {
+ log.debug("{} Error sealing refresh token for session data", getLogPrefix(), e);
+ // Is not an error, but the refresh token won't be stored.
+ }
+ } else {
+ tokens.addmember("refresh_token").string(refreshToken.getValue());
+ }
+ }
+
+ boolean accessTokenAdded = false;
if (localDataSealer != null) {
try {
tokens.addmember("access_token").string(localDataSealer.wrap(accessToken.getValue()));
accessTokenAdded = true;
} catch (final DataSealerException e) {
log.debug("{} Error sealing access token for session data", getLogPrefix(), e);
- // Is not an error, but the access token won't be stored.
+ // Is not an error, but the access token and its attributes won't be stored.
}
} else {
tokens.addmember("access_token").string(accessToken.getValue());
accessTokenAdded = true;
}
-
- // No need to set all the other attributes of an access_token if the access_token itself is not present
+
+ // Only add the attributes of an access_token if one exists
if (accessTokenAdded) {
tokens.addmember("token_type").string(accessToken.getType().getValue());
tokens.addmember("expires_in").longinteger(accessToken.getLifetime());
if (accessToken.getScope() != null) {
- tokens.addmember("scope").string(accessToken.getScope().toString());
+ tokens.addmember("scope").string(accessToken.getScope()
+ .stream()
+ .map(String::valueOf)
+ .filter(s -> !s.isBlank())
+ .distinct()
+ .collect(java.util.stream.Collectors.joining(" ")));
}
if (accessToken.getIssuedTokenType() != null) {
tokens.addmember("issued_token_type").string(accessToken.getIssuedTokenType().getURI().toString());
}
}
- if (refreshToken != null) {
- if (localDataSealer != null) {
- try {
- tokens.addmember("refresh_token").string(localDataSealer.wrap(refreshToken.getValue()));
- } catch (final DataSealerException e) {
- log.debug("{} Error sealing refresh token for session data", getLogPrefix(), e);
- // Is not an error, but the refresh token won't be stored.
- }
- } else {
- tokens.addmember("refresh_token").string(refreshToken.getValue());
- }
- }
//return tokens;
}
return null;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponseTest.java b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponseTest.java
index 768fc43..5e32a0b 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponseTest.java
+++ b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponseTest.java
@@ -15,7 +15,6 @@
package net.shibboleth.sp.oidc.profile.impl;
import org.mockito.Mockito;
-import org.opensaml.messaging.context.MessageContext;
import org.springframework.webflow.execution.Event;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
@@ -29,7 +28,6 @@ import com.nimbusds.oauth2.sdk.token.RefreshToken;
import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.context.AccessTokenResponseContext;
@@ -43,15 +41,11 @@ import net.shibboleth.sp.profile.ConsumerConstants;
import net.shibboleth.sp.profile.impl.BaseAgplicationActionTest;
/**
- *
+ * Tests for {@link PrepareAgentResponse}.
*/
public class PrepareAgentResponseTest extends BaseAgplicationActionTest{
private PrepareAgentResponse action;
-
- private MessageContext mc;
- private AuthenticationContext ac;
- private RelyingPartyContext rpc;
private AccessTokenResponseContext atrc;
private RelyingPartyContext partyContext;
@@ -64,9 +58,7 @@ public class PrepareAgentResponseTest extends BaseAgplicationActionTest{
super.beforeMethod();
action = new PrepareAgentResponse();
-
- ac = prc.ensureSubcontext(AuthenticationContext.class);
- mc = new MessageContext();
+
atrc = new AccessTokenResponseContext();
prc.ensureInboundMessageContext().addSubcontext(atrc);
@@ -76,15 +68,6 @@ public class PrepareAgentResponseTest extends BaseAgplicationActionTest{
prc.addSubcontext(partyContext);
}
-
-
- @Test
- public void testSuccess() {
-
- final Event event = action.execute(src);
- ActionTestingSupport.assertProceedEvent(event);
-
- }
@Test
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list