[java-opensaml] branch main updated: OSJ-432: Assertion validator allows null InResonseTo even if context ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=7f3252aa1b43e8495af80d41d8a3d58668a4b245

The following commit(s) were added to refs/heads/main by this push:
     new 7f3252aa1 OSJ-432: Assertion validator allows null InResonseTo even if context ...
7f3252aa1 is described below

commit 7f3252aa1b43e8495af80d41d8a3d58668a4b245
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri May 2 21:26:09 2025 -0400

    OSJ-432: Assertion validator allows null InResonseTo even if context ...
    
    Assertion validator allows null InResonseTo even if context supplies a
    value
---
 .../impl/AbstractSubjectConfirmationValidator.java     | 17 ++++++++---------
 .../impl/AbstractSubjectConfirmationValidatorTest.java | 18 +++++++++++++++---
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
index 4152b4bb0..2bc703b05 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
@@ -264,15 +264,6 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
         
         final String inResponseTo = 
                 StringSupport.trimOrNull(confirmationData.getInResponseTo());
-        if (inResponseTo == null) {
-            if (required) {
-                context.getValidationFailureMessages().add(
-                        "SubjectConfirmationData/@InResponseTo was missing and was required");
-                return ValidationResult.INVALID;
-            }
-            return ValidationResult.VALID;
-        }
-        
         log.debug("Evaluating SubjectConfirmationData at InResponseTo of: {}", inResponseTo);
 
         final String validInResponseTo;
@@ -291,6 +282,14 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
             return ValidationResult.INDETERMINATE;
         }
 
+        if (inResponseTo == null) {
+            if (required || validInResponseTo != null) {
+                context.getValidationFailureMessages().add(
+                        "SubjectConfirmationData/@InResponseTo was missing and was required");
+                return ValidationResult.INVALID;
+            }
+        }
+
         if (Objects.equals(inResponseTo, validInResponseTo)) {
             log.debug("Matched valid InResponseTo: {}", inResponseTo);
             return ValidationResult.VALID;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
index aaf3c15be..1ceff8478 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
@@ -350,17 +350,17 @@ public class AbstractSubjectConfirmationValidatorTest extends BaseAssertionValid
     }
     
     @Test
-    public void testNoInResponseTo() throws AssertionValidationException {
+    public void testNoInResponseToAndDefaultNotRequired() throws AssertionValidationException {
         getSubjectConfirmationData().setInResponseTo(null);
         
         ValidationContext validationContext = new ValidationContext(buildBasicStaticParameters());
         
         Assert.assertEquals(validator.validate(subjectConfirmation, getAssertion(), validationContext), 
-                ValidationResult.VALID);
+                ValidationResult.INVALID);
     }
     
     @Test
-    public void testNoInResponseToAndRequired() throws AssertionValidationException {
+    public void testNoInResponseToAndExplicitRequired() throws AssertionValidationException {
         getSubjectConfirmationData().setInResponseTo(null);
         
         Map<String,Object> staticParams = buildBasicStaticParameters();
@@ -371,6 +371,18 @@ public class AbstractSubjectConfirmationValidatorTest extends BaseAssertionValid
                 ValidationResult.INVALID);
     }
     
+    @Test
+    public void testNoInResponseToAndExplicitNotRequired() throws AssertionValidationException {
+        getSubjectConfirmationData().setInResponseTo(null);
+        
+        Map<String,Object> staticParams = buildBasicStaticParameters();
+        staticParams.put(SAML2AssertionValidationParameters.SC_IN_RESPONSE_TO_REQUIRED, Boolean.FALSE);
+        ValidationContext validationContext = new ValidationContext(staticParams);
+        
+        Assert.assertEquals(validator.validate(subjectConfirmation, getAssertion(), validationContext), 
+                ValidationResult.INVALID);
+    }
+    
     @Test
     public void testNoConfirmationDataAndInResponseToRequired() throws AssertionValidationException {
         subjectConfirmation.setSubjectConfirmationData(null);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.