[java-identity-provider] branch main updated: Return NoPassive error instead of consent when login is passive

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/1e9810efb3cc7fbb8ebcfb7fb806905409134423

The following commit(s) were added to refs/heads/main by this push:
     new 1e9810efb Return NoPassive error instead of consent when login is passive
1e9810efb is described below

commit 1e9810efb3cc7fbb8ebcfb7fb806905409134423
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Wed Nov 19 19:20:01 2025 -0600

    Return NoPassive error instead of consent when login is passive
    
    The NoPassive error page was displayed only if global consent was
    allowed (idp.consent.allowGlobal=true), now the error page is displayed
    instead of the consent page when global consent is not allowed
    (idp.consent.allowGlobal=false).
    
    https://shibboleth.atlassian.net/browse/IDP-2409
---
 .../idp/flows/intercept/attribute-release-flow.xml | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
index a0d71f7f2..424c1c4be 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
@@ -91,30 +91,30 @@
 
     <decision-state id="TestForReadGlobalAttributeConsentFromStorage">
         <if test="attributeReleaseFlowDescriptor.globalConsentAllowed"
-            then="ReadGlobalAttributeConsentFromStorage" else="PopulateConsentContext" />
+            then="ReadGlobalAttributeConsentFromStorage" else="TestForIsPassiveAndNoStorageRecords" />
     </decision-state>
 
     <action-state id="ReadGlobalAttributeConsentFromStorage">
         <evaluate expression="ReadGlobalAttributeConsentFromStorage" />
         <evaluate expression="'proceed'" />
         
-        <transition on="proceed" to="TestForIsPassiveAndNoStorageRecords" />
+        <transition on="proceed" to="TestForGlobalAttributeConsent" />
     </action-state>
 
 
-    <!-- Respond with NoPassive if IsPassive and no storage records were read. -->
+    <!-- If global consent has been given by user, skip the rest of the flow. -->
 
-    <decision-state id="TestForIsPassiveAndNoStorageRecords">
-        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() and opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentContext)).getPreviousConsents().isEmpty()"
-            then="NoPassive" else="TestForGlobalAttributeConsent" />
+    <decision-state id="TestForGlobalAttributeConsent">
+        <if test="GlobalAttributeConsentPredicate.test(opensamlProfileRequestContext)"
+            then="proceed" else="TestForIsPassiveAndNoStorageRecords" />
     </decision-state>
 
 
-    <!-- If global consent has been given by user, skip the rest of the flow. -->
-    
-    <decision-state id="TestForGlobalAttributeConsent">
-        <if test="GlobalAttributeConsentPredicate.test(opensamlProfileRequestContext)"
-            then="proceed" else="PopulateConsentContext" />
+    <!-- Respond with NoPassive if IsPassive and no storage records were read. -->
+
+    <decision-state id="TestForIsPassiveAndNoStorageRecords">
+        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() and opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentContext)).getPreviousConsents().isEmpty()"
+            then="NoPassive" else="PopulateConsentContext" />
     </decision-state>
 
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.