[java-opensaml] branch main updated: OSJ-432: Assertion validator allows null InResonseTo even if context ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=145b2395616a4a672c0ef8fc0f3798e9665b2814

The following commit(s) were added to refs/heads/main by this push:
     new 145b23956 OSJ-432: Assertion validator allows null InResonseTo even if context ...
145b23956 is described below

commit 145b2395616a4a672c0ef8fc0f3798e9665b2814
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Tue Jun 3 20:48:12 2025 -0400

    OSJ-432: Assertion validator allows null InResonseTo even if context ...
    
    Assertion validator allows null InResonseTo even if context supplies a
    value
    
    Clean up logic so that 1) missing context data does not result in
    INDETERMINATE result 2) don't special case where both are null, just
    fall through allow Object.equals() to eval directly.
---
 .../impl/AbstractSubjectConfirmationValidator.java       | 16 ++++------------
 .../impl/AbstractSubjectConfirmationValidatorTest.java   | 15 ++++++++++++++-
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
index 2bc703b05..55e4e0912 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
@@ -275,19 +275,11 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
                     "Unable to determine valid subject confirmation InResponseTo");
             return ValidationResult.INDETERMINATE;
         }
-        if (validInResponseTo == null) {
-            context.getValidationFailureMessages().add(
-                    "Valid InResponseTo was not available from the validation context, " 
-                            + "unable to evaluate SubjectConfirmationData at InResponseTo");
-            return ValidationResult.INDETERMINATE;
-        }
 
-        if (inResponseTo == null) {
-            if (required || validInResponseTo != null) {
-                context.getValidationFailureMessages().add(
-                        "SubjectConfirmationData/@InResponseTo was missing and was required");
-                return ValidationResult.INVALID;
-            }
+        if (inResponseTo == null && required) {
+            context.getValidationFailureMessages().add(
+                    "SubjectConfirmationData/@InResponseTo was missing and was required");
+            return ValidationResult.INVALID;
         }
 
         if (Objects.equals(inResponseTo, validInResponseTo)) {
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
index 1ceff8478..ecfaa8067 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
@@ -346,7 +346,20 @@ public class AbstractSubjectConfirmationValidatorTest extends BaseAssertionValid
         ValidationContext validationContext = new ValidationContext(staticParams);
         
         Assert.assertEquals(validator.validate(subjectConfirmation, getAssertion(), validationContext), 
-                ValidationResult.INDETERMINATE);
+                ValidationResult.INVALID);
+    }
+    
+    @Test
+    public void testMissingBothInResponseToParamAndValueValue() throws AssertionValidationException {
+        Map<String,Object> staticParams = buildBasicStaticParameters();
+        staticParams.remove(SAML2AssertionValidationParameters.SC_VALID_IN_RESPONSE_TO);
+        
+        getSubjectConfirmationData().setInResponseTo(null);
+        
+        ValidationContext validationContext = new ValidationContext(staticParams);
+        
+        Assert.assertEquals(validator.validate(subjectConfirmation, getAssertion(), validationContext), 
+                ValidationResult.VALID);
     }
     
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.