[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-68 - Consent revocation choice is cleared from the username input view

Phil Smart philip.smart at jisc.ac.uk
Wed Oct 29 11:59:58 UTC 2025 

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
https://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=bf6a1691e97b9a61056df56ebadd211991d45f22

The following commit(s) were added to refs/heads/main by this push:
     new bf6a169  JWEBAUTHN-68 - Consent revocation choice is cleared from the username input view
bf6a169 is described below

commit bf6a1691e97b9a61056df56ebadd211991d45f22
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Oct 29 11:59:54 2025 +0000

    JWEBAUTHN-68 - Consent revocation choice is cleared from the username
    input view
    
      - Added an input variable to both the webauthn authentication and
        username collection views that can be used to pre toggle the revoke
        consent checkbox.
      - Added that variable to the default templates
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-68
---
 .../net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml         | 4 +++-
 .../idp/plugin/authn/webauthn/views/webauthn-authn-username.vm        | 4 ++--
 .../net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm  | 4 ++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
index f68724a..74b0713 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
@@ -38,6 +38,7 @@
             <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="viewScope.authenticationContext" />
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnAuthenticationContext))" result="viewScope.webauthnContext" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentManagementContext))?.revokeConsent ?: false" result="viewScope.revokeConsent"/>
             <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" result="viewScope.rpUIContext" />
             <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationErrorContext))" result="viewScope.authenticationErrorContext" />
             <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationWarningContext))" result="viewScope.authenticationWarningContext" />
@@ -126,6 +127,7 @@
             <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="viewScope.authenticationContext" />
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnAuthenticationContext))" result="viewScope.webauthnContext" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentManagementContext))?.revokeConsent ?: false" result="viewScope.revokeConsent"/>
             <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" result="viewScope.rpUIContext" />
             <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationErrorContext))" result="viewScope.authenticationErrorContext" />
             <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationWarningContext))" result="viewScope.authenticationWarningContext" />
@@ -141,7 +143,7 @@
        
        <on-exit>
             <evaluate expression="opensamlProfileRequestContext.addSubcontext(new net.shibboleth.idp.consent.context.ConsentManagementContext(), true).setRevokeConsent(requestParameters._shib_idp_revokeConsent == 'true')" />
-        </on-exit>       
+        </on-exit>
     </view-state>
     
     <action-state id="ExtractPublicKeyCredentialAssertion">
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn-username.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn-username.vm
index 06179d2..2491895 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn-username.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn-username.vm
@@ -15,7 +15,7 @@
 ## request - HttpServletRequest
 ## response - HttpServletResponse
 ## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
+## revokeConsent - whether consent has been revoked from a previous view
 ##
 #set ($rpContext = $profileRequestContext.getSubcontext('net.shibboleth.profile.context.RelyingPartyContext'))
 #set ($eventCtx = $profileRequestContext.getSubcontext('org.opensaml.profile.context.EventContext'))
@@ -82,7 +82,7 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
                     <label for="donotcache">#springMessageText("idp.login.donotcache", "Don't Remember Login")</label>
 
                     #if ($serviceName && !$rpContext.getRelyingPartyId().contains($serviceName))
-                        <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true" />
+                        <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true" #if($revokeConsent)checked#end/>
                         <label for="_shib_idp_revokeConsent">#springMessageText("idp.attribute-release.revoke", "Clear prior granting of permission for release of your information to this service.")</label>
                     #end
                     <div class="grid">
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
index 8bd7576..5daff80 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
@@ -16,7 +16,7 @@
 ## request - HttpServletRequest
 ## response - HttpServletResponse
 ## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
+## revokeConsent - whether consent has been revoked from a previous view
 ##
 #set ($debug = $environment.getProperty("idp.authn.webauthn.ui.debug", "false"))
 #set ($inlineReg = $environment.getProperty("idp.authnwebauthn.registration.allowInline", "true"))
@@ -133,7 +133,7 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
                             <button class="hidden" id="authenticationSubmit" type="submit"
                                 name="_eventId_proceed">#springMessageText("idp.webauthn.authn.submit", "Submit
                             authentication")</button>
-                            <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true" />
+                            <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true" #if($revokeConsent)checked#end/>
                             <label for="_shib_idp_revokeConsent">#springMessageText("idp.attribute-release.revoke", "Clear prior granting of permission for release of your information to this service.")</label>
                         </form>
                         #if($debug == "true")

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.

More information about the commits mailing list