[cpp-sp] branch main updated: Omit handler parameter when discovery attempt detected.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=428985f6d0401d46e52ab04ab878914d9bfba503

The following commit(s) were added to refs/heads/main by this push:
     new 428985f6 Omit handler parameter when discovery attempt detected.
428985f6 is described below

commit 428985f6d0401d46e52ab04ab878914d9bfba503
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 25 19:18:54 2025 -0400

    Omit handler parameter when discovery attempt detected.
---
 shibsp/handler/impl/SessionInitiator.cpp | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/shibsp/handler/impl/SessionInitiator.cpp b/shibsp/handler/impl/SessionInitiator.cpp
index 5d254b87..acbf9c31 100644
--- a/shibsp/handler/impl/SessionInitiator.cpp
+++ b/shibsp/handler/impl/SessionInitiator.cpp
@@ -93,29 +93,42 @@ pair<bool,long> SessionInitiator::run(SPRequest& request, bool isHandler) const
 
     try {
         if (isHandler) {
+            // Check for a DS parameter in the query string. This is a loop-breaking indicator
+            // that this is a request in resoonse to a discovery round trip and will impact how
+            // the request to the hub is made, to ensure a loop back to a DS is avoided.
+            const char* param = request.getParameter("DS");
+            bool discovery = param && !strcmp(param, "1");
+
             // Check for a state parameter in the query string.
-            const char* param = request.getParameter("state");
+            param = request.getParameter("state");
             if (param) {
                 // We'll pass state as is and target will be omitted.
                 state = param;
+                
                 // handler can be derived from "this" URL since this is a re-entrant call to this handler,
                 // i.e., we know this is the right URL to use because "it already was" originally.
                 handlerBaseURL = request.getHandlerURL(request.getRequestURL());
-                handler = handlerBaseURL + m_path;
+                if (!discovery) {
+                    handler = handlerBaseURL + m_path;
+                }
             }
             else {
                 // target will come from query string, map, or handler or fall back to this request.
                 // TODO: shouldm't this fall back to homeURL?
                 target = getString("target", request, request.getRequestURL());
+
                 // handler is derived from the target resource.
                 handlerBaseURL = request.getHandlerURL(target.c_str());
-                handler = handlerBaseURL + m_path;
+                if (!discovery) {
+                    handler = handlerBaseURL + m_path;
+                }
             }
         }
         else {
             // Check for a hardwired target value in the map or handler.
             target = getString("target", request, request.getRequestURL(),
                 HANDLER_PROPERTY_FIXED | HANDLER_PROPERTY_MAP);
+                
             // state is empty since this is a direct resource request.
             // handler is derived from the target resource
             handlerBaseURL = request.getHandlerURL(target.c_str());
@@ -130,7 +143,12 @@ pair<bool,long> SessionInitiator::run(SPRequest& request, bool isHandler) const
         input.structure();
         input.addmember("application").string(settings->getString(
             RequestMapper::APPLICATION_ID_PROP_NAME, RequestMapper::APPLICATION_ID_PROP_DEFAULT));
-        input.addmember("handler").unsafe_string(handler.c_str());
+        
+        // Will be set unless discovery was already attempted.
+        if (!handler.empty()) {
+            input.addmember("handler").unsafe_string(handler.c_str());
+        }
+
         if (state.empty()) {
             input.addmember("target").unsafe_string(target.c_str());
         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.