[java-identity-provider] 02/02: OSJ-427: Simple signature verification fails to detect parameter ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=11dec9bf2c179690ab6379e03e7e7d212d6fc877

commit 11dec9bf2c179690ab6379e03e7e7d212d6fc877
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Mar 21 15:14:08 2025 -0400

    OSJ-427: Simple signature verification fails to detect parameter ...
    
    Inbound front-channel SLO requests can be either SAMLRequest or
    SAMLResponse.
---
 .../shibboleth/idp/conf/saml-binding-config.xml    | 24 ++++++++++++++++++++++
 .../idp/flows/saml/saml2/slo-post-beans.xml        |  2 +-
 .../flows/saml/saml2/slo-post-simplesign-beans.xml |  2 +-
 .../idp/flows/saml/saml2/slo-redirect-beans.xml    |  2 +-
 4 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
index 4b4bd4005..1ec47cdd7 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
@@ -206,6 +206,14 @@
         </property>
     </bean>
     
+    <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect.RequestOrResponse"
+          parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect">
+        <property name="requiredParameters">
+            <set>
+            </set>
+        </property>
+    </bean>
+    
     <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign"
           parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
         <property name="requiredParameters">
@@ -232,6 +240,14 @@
         </property>
     </bean>
     
+    <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.RequestOrResponse"
+          parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign">
+        <property name="requiredParameters">
+            <set>
+            </set>
+        </property>
+    </bean>
+    
     <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST"
           parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
         <property name="requiredParameters">
@@ -254,6 +270,14 @@
         </property>
     </bean>
     
+    <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.RequestOrResponse"
+          parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST">
+        <property name="requiredParameters">
+            <set>
+            </set>
+        </property>
+    </bean>
+    
     <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact"
           parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
         <property name="requiredParameters">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
index 5839efe2f..0d41c8455 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
@@ -11,7 +11,7 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
        
-    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST" />
+    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.RequestOrResponse" />
 
     <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
             p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
index fd4be59ea..9a1deb489 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
@@ -11,7 +11,7 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
        
-    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign" />
+    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.RequestOrResponse" />
 
     <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
             p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
index 5ae7df4c8..902840aa4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
@@ -11,7 +11,7 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
        
-    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect" />
+    <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect.RequestOrResponse" />
         
     <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
             p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.