[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-48 - Default cleanup hook is not wired up correctly

Phil Smart philip.smart at jisc.ac.uk
Mon Mar 10 14:54:59 UTC 2025 

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=707dff4ab1f56ccfaf5c133d21fde71f2aab2a76

The following commit(s) were added to refs/heads/main by this push:
     new 707dff4  JWEBAUTHN-48 - Default cleanup hook is not wired up correctly
707dff4 is described below

commit 707dff4ab1f56ccfaf5c133d21fde71f2aab2a76
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Mar 10 14:54:55 2025 +0000

    JWEBAUTHN-48 - Default cleanup hook is not wired up correctly
    
     - Add the property to the properties file
     - Wire it up correctly to the property
     - set it to false in the flow tests so we can still check the context
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-48
---
 .../net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml        | 4 ++--
 .../idp/plugin/authn/webauthn/conf/authn/webauthn.properties          | 2 ++
 .../webauthn/flow/TestWebAuthn2FaApplicationContextInitializer.java   | 2 ++
 .../TestWebAuthn2FaWithFilterPolicyApplicationContextInitializer.java | 2 ++
 .../TestWebAuthnAdminManagementApplicationContextInitializer.java     | 2 ++
 .../flow/TestWebAuthnPasswordlessApplicationContextInitializer.java   | 2 ++
 ...dlessTriggerEventOnNoCredentialsApplicationContextInitializer.java | 2 ++
 ...uthnPasswordlessWithFilterPolicyApplicationContextInitializer.java | 2 ++
 ...stWebAuthnPasswordlessWithPolicyApplicationContextInitializer.java | 2 ++
 .../flow/TestWebAuthnRegistrationApplicationContextInitializer.java   | 2 ++
 .../flow/TestWebAuthnUsernamelessApplicationContextInitializer.java   | 2 ++
 ...stWebAuthnUsernamelessWithPolicyApplicationContextInitializer.java | 2 ++
 12 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index c7721d2..562d9f7 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -189,8 +189,8 @@
         p:updateSignatureCountPredicate="#{getObject('shibboleth.authn.WebAuthn.UpdateSignatureCountPredicate') ?: %{idp.authn.webauthn.updateSignatureCount:true}}"
         p:updateLastUsedTimePredicate="#{getObject('shibboleth.authn.WebAuthn.UpdateLastUsedTimePredicate') ?: %{idp.authn.webauthn.updateLastUsedTime:false}}"    
         p:populateAuditContextAction="#{%{idp.authn.webauthn.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('shibboleth.authn.WebAuthn.PopulateAuditContext') : null}"
-        p:writeAuditLogAction="#{%{idp.authn.webauthn.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}"
-        p:cleanupHook="#{getObject('shibboleth.authn.WebAuthn.RemoveAfterValidation') == true ? getObject('DefaultCleanupHook') : null}"        
+        p:writeAuditLogAction="#{%{idp.authn.webauthn.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}" 
+        p:cleanupHook="#{T(java.lang.Boolean).valueOf('%{idp.authn.webauthn.removeAfterValidation:true}') ? getObject('DefaultCleanupHook') : null}"
         p:classifiedMessages="#{getObject('shibboleth.authn.WebAuthn.ClassifiedMessageMap')}"/>
         
     <bean id="DefaultCleanupHook" class="net.shibboleth.idp.plugin.authn.webauthn.impl.ValidateWebAuthnAssertion.WebAuthnCleanupHook"/>    
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 44c5037..57dbfda 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -22,6 +22,8 @@ idp.authn.webauthn.relyingPartyName = Shibboleth
 idp.authn.webauthn.supportedPrincipals = \
     saml2/http://example.org/ac/classes/mfa, \
     saml1/http://example.org/ac/classes/mfa
+# Override to keep the WebAuthnContext around
+#idp.authn.webauthn.removeAfterValidation = true
 
 # An override of origins this RP allows in a responses from an authenticator
 #idp.authn.webauthn.origins = 
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaApplicationContextInitializer.java
index b4c0f1a..8d484e9 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaApplicationContextInitializer.java
@@ -43,6 +43,8 @@ public class TestWebAuthn2FaApplicationContextInitializer
         final MockPropertySource mock = new MockPropertySource("2fa-mock-properties");
         mock.setProperty("idp.authn.webauthn.2fa.enabled", "true");
         mock.setProperty("idp.authn.webauthn.2fa.allowedPreviousFactors", "authn/Password");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaWithFilterPolicyApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaWithFilterPolicyApplicationContextInitializer.java
index e55dbfe..e32d6b9 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaWithFilterPolicyApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthn2FaWithFilterPolicyApplicationContextInitializer.java
@@ -44,6 +44,8 @@ public class TestWebAuthn2FaWithFilterPolicyApplicationContextInitializer
         mock.setProperty("idp.authn.webauthn.2fa.enabled", "true");
         mock.setProperty("idp.authn.webauthn.2fa.allowedPreviousFactors", "authn/Password");
         mock.setProperty("idp.authn.webauthn.credential.filter.policy.enabled", "true");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnAdminManagementApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnAdminManagementApplicationContextInitializer.java
index a81231c..869df6a 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnAdminManagementApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnAdminManagementApplicationContextInitializer.java
@@ -51,6 +51,8 @@ public class TestWebAuthnAdminManagementApplicationContextInitializer
         mock.setProperty("idp.authn.webauthn.admin.management.accessPolicy", "AccessByIPAddress");
         // Don't require special authentication
         mock.setProperty("idp.authn.webauthn.admin.management.defaultAuthenticationMethods", "");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessApplicationContextInitializer.java
index 02188c5..2bfe1ba 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessApplicationContextInitializer.java
@@ -42,6 +42,8 @@ public class TestWebAuthnPasswordlessApplicationContextInitializer
     @Override public void initialize(@Nonnull final ConfigurableApplicationContext applicationContext) {
         final MockPropertySource mock = new MockPropertySource("passwordless-mock-properties");
         mock.setProperty("idp.authn.webauthn.usernameless.enabled", "false");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessTriggerEventOnNoCredentialsApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessTriggerEventOnNoCredentialsApplicationContextInitializer.java
index a11f3ed..779cb0e 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessTriggerEventOnNoCredentialsApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessTriggerEventOnNoCredentialsApplicationContextInitializer.java
@@ -43,6 +43,8 @@ public class TestWebAuthnPasswordlessTriggerEventOnNoCredentialsApplicationConte
         final MockPropertySource mock = new MockPropertySource("passwordless-mock-properties");
         mock.setProperty("idp.authn.webauthn.usernameless.enabled", "false");
         mock.setProperty("idp.authn.webauthn.signalEventOnNoCredentialsRegisteredForUserHandle", "true");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithFilterPolicyApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithFilterPolicyApplicationContextInitializer.java
index eae00e6..f7b630f 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithFilterPolicyApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithFilterPolicyApplicationContextInitializer.java
@@ -43,6 +43,8 @@ public class TestWebAuthnPasswordlessWithFilterPolicyApplicationContextInitializ
         final MockPropertySource mock = new MockPropertySource("passwordless-mock-properties");
         mock.setProperty("idp.authn.webauthn.usernameless.enabled", "false");
         mock.setProperty("idp.authn.webauthn.credential.filter.policy.enabled", "true");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithPolicyApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithPolicyApplicationContextInitializer.java
index ea383b3..727903a 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithPolicyApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnPasswordlessWithPolicyApplicationContextInitializer.java
@@ -43,6 +43,8 @@ public class TestWebAuthnPasswordlessWithPolicyApplicationContextInitializer
         final MockPropertySource mock = new MockPropertySource("passwordless-mock-properties");
         mock.setProperty("idp.authn.webauthn.usernameless.enabled", "false");
         mock.setProperty("idp.authn.webauthn.credential.policy.enabled", "true");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnRegistrationApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnRegistrationApplicationContextInitializer.java
index 30ca111..f8f497b 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnRegistrationApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnRegistrationApplicationContextInitializer.java
@@ -49,6 +49,8 @@ public class TestWebAuthnRegistrationApplicationContextInitializer
         mock.setProperty("idp.authn.flows", "WebAuthn");
         // Remove access checks
         mock.setProperty("idp.authn.webauthn.admin.registration.accessPolicy", "AccessByIPAddress");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessApplicationContextInitializer.java
index b02da62..2fc4883 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessApplicationContextInitializer.java
@@ -42,6 +42,8 @@ public class TestWebAuthnUsernamelessApplicationContextInitializer
     @Override public void initialize(@Nonnull final ConfigurableApplicationContext applicationContext) {
         final MockPropertySource mock = new MockPropertySource("usernameless-mock-properties");
         mock.setProperty("idp.authn.webauthn.usernameless.enabled", "true");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessWithPolicyApplicationContextInitializer.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessWithPolicyApplicationContextInitializer.java
index 4a06889..fa4f556 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessWithPolicyApplicationContextInitializer.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestWebAuthnUsernamelessWithPolicyApplicationContextInitializer.java
@@ -44,6 +44,8 @@ public class TestWebAuthnUsernamelessWithPolicyApplicationContextInitializer
         mock.setProperty("idp.authn.webauthn.usernameless.enabled", "true");
         mock.setProperty("idp.authn.webauthn.credential.policy.enabled", "true");        
         mock.setProperty("idp.authn.webauthn.authenticator.policy.secondFactorOnlyAuthenticators", "9231fe6c-def3-4856-cbc1-e940bb035246");
+        // turn off context cleanup so we can check it
+        mock.setProperty("idp.authn.webauthn.removeAfterValidation", "false");
         applicationContext.getEnvironment().getPropertySources().addFirst(mock);
         log.info("Prepending usernameless properties '{}'", mock.getSource());
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.

More information about the commits mailing list