[java-identity-provider] branch main updated: OSJ-427: Simple signature verification fails to detect parameter ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=bbd713344fed5f2b0cdff77dcc2c20aa56221f84

The following commit(s) were added to refs/heads/main by this push:
     new bbd713344 OSJ-427: Simple signature verification fails to detect parameter ...
bbd713344 is described below

commit bbd713344fed5f2b0cdff77dcc2c20aa56221f84
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Mon Mar 24 11:53:20 2025 -0400

    OSJ-427: Simple signature verification fails to detect parameter ...
    
    HTTP request validator for SAML AuthN should require SAMLResponse not
    SAMLRequest.
---
 .../net/shibboleth/idp/conf/mvc-beans.xml          |  2 +-
 .../shibboleth/idp/conf/saml-binding-config.xml    | 30 ++++++++++++++++++++++
 .../idp/flows/authn/saml-authn-beans.xml           |  3 ++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
index df230f3cb..dafb78809 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
@@ -65,7 +65,7 @@
     <bean id="shibboleth.RaiseErrorController" class="net.shibboleth.shared.spring.error.ErrorRaisingController" />
     
     <util:map id="shibboleth.SAMLAuthnPOSTController.HttpServletRequestValidatorMap">
-        <entry key="POST" value-ref="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST" />
+        <entry key="POST" value-ref="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.Response" />
     </util:map>
 
     <!-- Exception handling -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
index f0aed3fec..3500b7402 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
@@ -318,6 +318,36 @@
             </set>
         </property>
     </bean>
+     
+    <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.Response"
+          parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+        <property name="allowedParameters">
+            <set>
+                <value>SAMLResponse</value>
+                <value>RelayState</value>
+            </set>
+        </property>
+        <property name="requiredParameters">
+            <set>
+                <value>SAMLResponse</value>
+            </set>
+        </property>
+        <property name="uniqueParameters">
+            <set>
+                <value>SAMLRequest</value>
+                <value>SAMLResponse</value>
+                <value>RelayState</value>
+            </set>
+        </property>
+        <property name="mutuallyExclusiveParameters">
+            <set>
+                <set>
+                    <value>SAMLRequest</value>
+                    <value>SAMLResponse</value>
+                </set>
+            </set>
+        </property>
+    </bean>
     
     <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.RequestOrResponse"
           parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index 9f2e5a342..e0d63aeff 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -199,7 +199,8 @@
         p:messageEncoderFactory-ref="messageEncoderFactory"
         p:messageHandler="#{getObject('shibboleth.BindingSpecificMessageHandler')}" />
 
-    <!-- This is mostly a placeholder in case we get forced to support other bindings at some point. -->
+    <!-- This is mostly a placeholder in case we get forced to support other bindings at some point.
+         NOTE: If do support other bindings, need to also update HTTP validators defined in mvc-beans.xml. -->
 
     <bean id="messageDecoderFactory" class="net.shibboleth.idp.saml.profile.impl.SpringAwareMessageDecoderFactory">
         <property name="beanMappings">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.