[java-plugin-shibd-oidc] branch main updated: Add back IssuerClaimsValidator, set tokens into session data output
Codeberg
noreply at shibboleth.net
Mon Dec 22 15:30:46 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/33b9336d67b015e0b4a70d6b272edd8a16accc1a
The following commit(s) were added to refs/heads/main by this push:
new 33b9336 Add back IssuerClaimsValidator, set tokens into session data output
33b9336 is described below
commit 33b9336d67b015e0b4a70d6b272edd8a16accc1a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Dec 22 15:30:36 2025 +0000
Add back IssuerClaimsValidator, set tokens into session data output
- also fix session initiator flow tests
---
.../shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml | 13 +++++--------
.../net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml | 5 +----
.../sp/oidc/flows/OIDCSessionInitiatorFlowTest.java | 8 +++++++-
.../shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java | 5 ++---
.../java/net/shibboleth/sp/oidc/flows/TestConstants.java | 7 +++++--
.../sp/oidc/profile/impl/PrepareAgentResponse.java | 6 +++---
.../oidc/profile/impl/SetIssuerToPeerContextConsumer.java | 2 +-
.../sp/oidc/profile/impl/ValidateResponseState.java | 12 ++++++------
8 files changed, 30 insertions(+), 28 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
index 487b097..f1de866 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
@@ -260,7 +260,7 @@
<util:list id="IDTokenClaimsValidators" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
<ref bean="IDTokenRequiredClaimsValidator" />
- <!-- <ref bean="IssuerClaimsValidator" /> -->
+ <ref bean="IssuerClaimsValidator" />
<!-- <ref bean="AudienceClaimsValidator" /> -->
<ref bean="AzpClaimRequiredValidator" />
<!-- ref bean="AzpClaimsValidator" /> -->
@@ -328,10 +328,7 @@
<bean id="IssuerIDFromOIDCProviderMetadataContextLookupFunction" scope="prototype"
class="net.shibboleth.oidc.profile.logic.IssuerIDFromOIDCProviderMetadataContextLookupFunction"
- p:oIDCMetadataContextLookupStrategy-ref="OIDCProviderMetadataContextFromOutboundPeerLookupStrategy" />
-
- <bean id="OIDCProviderMetadataContextFromOutboundPeerLookupStrategy"
- class="net.shibboleth.oidc.profile.context.navigate.OIDCProviderMetadataFromOuboundPeerLookupStrategy" />
+ p:oIDCMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromInboundMessageContext" />
<bean id="AudienceClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator"
p:audienceLookupStrategy-ref="ClientIDFromOAuth2ClientContextFunction"
@@ -425,7 +422,7 @@
<bean id="DefaultUserInfoRequestEncoder" scope="prototype"
class="net.shibboleth.oidc.profile.encoding.impl.UserInfoRequestEncoder"
p:providerMetadataLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromInboundMessageContext"
- p:oAuth2ClientAuthenticationContextLookupStrategy-ref="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContextFromInboundMessageContext"/>
+ p:oAuth2ClientAuthenticationContextLookupStrategy-ref="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContextFromInboundMessageContext"/>
<bean id="CheckUserInfoPlainResponseTypeCondition"
class="net.shibboleth.sp.oidc.messaging.context.logic.UserInfoPlainResponseTypeCondition" />
@@ -533,8 +530,8 @@
<util:list id="UserInfoClaimsValidators" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
<ref bean="UserInfoTokenRequiredClaimsValidator" />
<ref bean="SubMatchesIDTokenClaimValidator" />
- <!-- <ref bean="IssuerClaimsValidator" />
- <ref bean="AudienceClaimsValidator" /> -->
+ <ref bean="IssuerClaimsValidator" />
+ <!-- <ref bean="AudienceClaimsValidator" /> -->
</util:list>
<bean id="UserInfoTokenRequiredClaimsValidator"
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
index d17369e..7cc51ec 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
@@ -75,9 +75,6 @@
<action-state id="FinalizeResponse">
<evaluate expression="ProcessEndUserClaims" />
-
- <!-- <evaluate expression="ValidateOIDCAuthentication" /> -->
-
<evaluate expression="ExtractOIDCClaims"/>
<evaluate expression="PrepareAgentResponse"/>
<evaluate expression="'proceed'" />
@@ -88,7 +85,7 @@
<global-transitions>
<!-- Remap some internal action errors. -->
<transition on="InvalidCredentials" to="InvalidMessage" />
- <transition on="UnableToValidateAssertion" to="MessageProcessingError" />
+ <transition on="InvalidToken" to="MessageProcessingError" />
</global-transitions>
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
index d4ed22a..91f4fc0 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
@@ -44,6 +44,8 @@ import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import net.shibboleth.idp.spring.IdPPropertiesApplicationContextInitializer;
+import net.shibboleth.idp.test.PreferFileSystemApplicationContextInitializer;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.sp.context.AgentRequestContext;
import net.shibboleth.sp.ddf.DDF;
@@ -60,9 +62,13 @@ import net.shibboleth.sp.profile.impl.IssueCorrelationCookie;
"classpath:/net/shibboleth/sp/oidc-test-beans.xml", },
initializers = {
TestSPOIDCEnvironmentApplicationContextInitializer.class,
- }
+ PreferFileSystemApplicationContextInitializer.class,
+ IdPPropertiesApplicationContextInitializer.class
+ },
+ inheritInitializers = false
)
@WebAppConfiguration
+ at SuppressWarnings({ "unchecked", "rawtypes", "null" })
public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
/** Flow ID. */
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
index e69f1a5..85eb332 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
@@ -78,7 +78,6 @@ import com.nimbusds.openid.connect.sdk.claims.UserInfo;
import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
import net.minidev.json.JSONObject;
-import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.spring.IdPPropertiesApplicationContextInitializer;
import net.shibboleth.idp.test.PreferFileSystemApplicationContextInitializer;
import net.shibboleth.oidc.security.credential.JWKCredential;
@@ -239,7 +238,7 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
}
/**
- * Test successful flow.
+ * Test bad state.
*
* @throws IOException
*/
@@ -258,7 +257,7 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
final FlowExecutionResult result = flowExecutor.launchExecution(TestConstants.FLOW_ID, null, externalContext);
assertFlowExecutionResult(result, TestConstants.FLOW_ID);
assertFlowExecutionOutcome(result.getOutcome());
- assertOutputMessageEvent(result, AuthnEventIds.NO_CREDENTIALS);
+ assertOutputMessageEvent(result, EventIds.MESSAGE_PROC_ERROR);
}
/**
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java
index da9c9de..3dd5dd7 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java
@@ -65,9 +65,12 @@ public final class TestConstants {
__Host-_shibsp_iss_1761316967710_1622a5c726da8f7b36e24f19eed82aea=https%3A%2F%2Fop.example.org;
""";
- //TODO this is not bad state
+ /**
+ * Cookie headers representing a bad state string where the nonce is incorrect, as recovered from
+ * the __Host-_shibsp_req cookie.
+ */
public static final String COOKIE_HEADER_BAD_STATE = """
- __Host-_shibsp_req_1761316967710_1622a5c726da8f7b36e24f19eed82aea=f26d922221226cd183729bf13247dbe2;
+ __Host-_shibsp_req_1761316967710_1622a5c726da8f7b36e24f19eed82aea=222cbf13247dbe2;
_Host-shibsp_state__test-oidc-application-with-ro_1761316967710_1622a5c726da8f7b36e24f19eed82aea=aHR0cHM6Ly9zcC5leGFtcGxlLm9yZy9zZWN1cmU;
__Host-_shibsp_iss_1761316967710_1622a5c726da8f7b36e24f19eed82aea=https%3A%2F%2Fop.example.org;
""";
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
index 5b0a722..6bcaf0a 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
@@ -122,7 +122,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
/** {@inheritDoc} */
@Override
- protected String getSessionData(final ProfileRequestContext profileRequestContext) {
+ protected DDF getSessionData(final ProfileRequestContext profileRequestContext) {
final OIDCTokenResponse tokenResponse = tokenResponseContext.getTokenResponse();
if (tokenResponse != null) {
@@ -130,7 +130,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
final RefreshToken refreshToken = tokenResponse.getTokens().getRefreshToken();
log.debug("{} Storing access and refresh tokens in session data", getLogPrefix());
- final DDF tokens = new DDF(null).structure();
+ final DDF tokens = new DDF("tokens").structure();
final DataSealer localDataSealer = dataSealer;
@@ -179,7 +179,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
}
}
- //return tokens;
+ return tokens;
}
return null;
}
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/SetIssuerToPeerContextConsumer.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/SetIssuerToPeerContextConsumer.java
index 7f4f277..1795aed 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/SetIssuerToPeerContextConsumer.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/SetIssuerToPeerContextConsumer.java
@@ -28,7 +28,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A consumer that sets the decoded issuer value onto the {@link OIDCPeerEntityContext} (creating a peer entity
- * context is none already exists).
+ * context if none already exists).
*
* <p>A failure to set the value does not result in an error. The lack of context information will be caught downstream.
* </p>
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateResponseState.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateResponseState.java
index d1ec508..422e4a5 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateResponseState.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateResponseState.java
@@ -23,7 +23,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
@@ -34,7 +33,8 @@ import net.shibboleth.sp.context.TokenConsumerContext;
import net.shibboleth.sp.profile.AbstractApplicationAction;
/**
- *
+ * An action that validates that the nonce in the OAuth 2.0 state parameter in the response matches that recovered from
+ * the stored nonce.
*/
public class ValidateResponseState extends AbstractApplicationAction {
@@ -77,19 +77,19 @@ public class ValidateResponseState extends AbstractApplicationAction {
final String nonceFromStateParam = nonceTokenLookupStrategy.apply(profileRequestContext);
- // TODO is only required if we sent a state parameter?
+ // We always require state, otherwise we can not recover the values we need
if (StringSupport.trimOrNull(nonceFromCorrelationCookie) == null ||
StringSupport.trimOrNull(nonceFromStateParam) == null) {
log.error("{} The state parameter was not present in both the request and response, "
- + "state is mandatory in OIDC requests",getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ + "state is required",getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
return;
}
assert nonceFromCorrelationCookie != null;
if (!nonceFromCorrelationCookie.equals(nonceFromStateParam)) {
log.error("{} Request state '{}' did not match response state '{}', has it been tampered with!",
getLogPrefix(), nonceFromCorrelationCookie, nonceFromStateParam);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
+ ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
return;
}
// else state is fine.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list