[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-78 - Honour the idp.authn.audit.enabled property
Phil Smart
philip.smart at jisc.ac.uk
Thu Nov 13 16:48:56 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
https://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=570517539b29e0f4fcd3d15d6928f3f671871775
The following commit(s) were added to refs/heads/main by this push:
new 5705175 JOIDCRP-78 - Honour the idp.authn.audit.enabled property
5705175 is described below
commit 570517539b29e0f4fcd3d15d6928f3f671871775
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 13 16:48:54 2025 +0000
JOIDCRP-78 - Honour the idp.authn.audit.enabled property
- The audit log writing action now honours the idp audit enabled
property and its own audit toggle idp.authn.oidc.rp.audit.enabled.
- Cleaned up the TransitionActionWriteAuditLog action.
https://shibboleth.atlassian.net/browse/JOIDCRP-78
---
.../audit/impl/TransitionActionWriteAuditLog.java | 68 ++++++++++++++++++++--
.../oidc-relying-party-authn-beans.xml | 6 +-
.../authn/oidc/rp/conf/authn/oidc-rp.properties | 4 +-
3 files changed, 67 insertions(+), 11 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
index e162202..a76fe7d 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
@@ -15,22 +15,80 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.springframework.webflow.execution.Event;
+import org.springframework.webflow.execution.RequestContext;
+import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.audit.impl.WriteAuditLog;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
/**
- * A simple extension of the {@link WriteAuditLog} action that creates an Event with the string
- * literal '{@literal success}', such that the write audit log action can be used inside a transition
- * and does not prevent the transition from proceeding.
+ * An action that decorates the {@link WriteAuditLog} action to produce a "success" event such that it can be
+ * run inside a transition and the transition can proceed.
+ *
+ * <p>In Spring WebFlow, actions that are executed inside a transition must return an event ID based on one of the
+ * {@code trueEventIds} described by the {@code ActionTransitionCriteria} criteria. These are "success", "yes", or
+ * "true". Any other event ID will prevent the transition from executing, returning you to the previous state.</p>
+ *
*/
-public class TransitionActionWriteAuditLog extends WriteAuditLog {
+public class TransitionActionWriteAuditLog extends AbstractProfileAction {
+
+ /** Optional audit output action. */
+ @NonnullAfterInit private WriteAuditLog writeAuditLogAction;
+
+ /** The Spring RequestContext to operate on. */
+ @Nullable private RequestContext requestContext;
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+ if (writeAuditLogAction == null) {
+ throw new ComponentInitializationException("WriteAuditLog action cannot be null");
+ }
+ }
+
+ /**
+ * Sets an audit output action to run.
+ *
+ * @param action action to use to write to audit log
+ */
+ public void setWriteAuditLogAction(@Nonnull final WriteAuditLog action) {
+ checkSetterPreconditions();
+ writeAuditLogAction = Constraint.isNotNull(action, "WriteAuditLog action cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected Event doExecute(@Nonnull final RequestContext springRequestContext,
+ @Nonnull final ProfileRequestContext profileRequestContext) {
+
+ requestContext = springRequestContext;
+ return super.doExecute(springRequestContext, profileRequestContext);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final boolean shouldExecute = super.doPreExecute(profileRequestContext);
+ if (shouldExecute) {
+ return true;
+ }
+ // Signal success even if we skip execution. Otherwise the transition will fail.
+ ActionSupport.buildEvent(profileRequestContext, "success");
+ return false;
+ }
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- super.doExecute(profileRequestContext);
+ writeAuditLogAction.execute(requestContext);
+ // Signal success to allow transition to proceed, regardless of WriteAuditLog outcome.
ActionSupport.buildEvent(profileRequestContext, "success");
}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 82b28a5..95b42f5 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -154,6 +154,7 @@
p:formattingMap-ref="shibboleth.AuditFormattingMap"
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
+ p:activationCondition="#{%{idp.authn.audit.enabled:false} and %{idp.authn.oidc.rp.audit.enabled:false} ? true : false}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
<bean id="RequestObjectRequiredAndSupportedPredicate" scope="prototype"
@@ -881,10 +882,7 @@
<bean id="WriteAuditLogInTransition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.TransitionActionWriteAuditLog" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:formattingMap-ref="shibboleth.AuditFormattingMap"
- p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
- p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
+ p:writeAuditLogAction-ref="WriteAuditLog"/>
<!-- Can override one or more of the beans above. Note, the property override is mostly to allow tests to change the
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index 4648020..3f4b60d 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -79,5 +79,5 @@ idp.authn.oidc.rp.c14n.subjectidentifier.disabled = false
#idp.authn.oidc.rp.passiveAuthenticationSupported = true
#idp.authn.oidc.rp.forcedAuthenticationSupported = true
-
-
+## Audit settings
+#idp.authn.oidc.rp.audit.enabled = false
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list