[java-plugin-shibd] branch main updated: Eliminiate unnecessary hack for tracking passive SSO.
Scott Cantor
cantor.2 at osu.edu
Tue Sep 23 17:57:27 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=5f21cab0de4390ca3a6efc4c89328ff741eadf74
The following commit(s) were added to refs/heads/main by this push:
new 5f21cab Eliminiate unnecessary hack for tracking passive SSO.
5f21cab is described below
commit 5f21cab0de4390ca3a6efc4c89328ff741eadf74
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 23 13:57:21 2025 -0400
Eliminiate unnecessary hack for tracking passive SSO.
---
.../idp/flows/sp/consumer/consumer-flow.xml | 2 ++
.../sp/context/TokenConsumerContext.java | 30 ---------------------
.../AbstractTokenConsumerResponseAction.java | 6 -----
.../sp/profile/impl/IssueCorrelationCookie.java | 31 +++-------------------
.../sp/profile/impl/PrepareAgentErrorResponse.java | 7 -----
.../sp/profile/impl/ProcessCorrelationCookie.java | 11 ++------
.../profile/impl/IssueCorrelationCookieTest.java | 24 ++++++-----------
.../profile/impl/ProcessCorrelationCookieTest.java | 15 +++++------
8 files changed, 21 insertions(+), 105 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/consumer-flow.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/consumer-flow.xml
index 46f34cb..63e0916 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/consumer-flow.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/consumer-flow.xml
@@ -20,6 +20,7 @@
<end-state id="InvalidRelyingPartyConfiguration" />
<end-state id="InvalidSecurityConfiguration" />
<end-state id="MessageProcessingError" />
+ <end-state id="NoPassive" />
<end-state id="ReselectFlow" />
<end-state id="RuntimeException" />
@@ -40,6 +41,7 @@
<transition on="InvalidRelyingPartyContext" to="InvalidRelyingPartyContext" />
<transition on="InvalidRelyingPartyConfiguration" to="InvalidRelyingPartyConfiguration" />
<transition on="InvalidSecurityConfiguration" to="InvalidSecurityConfiguration" />
+ <transition on="NoPassive" to="NoPassive" />
<transition on="ReselectFlow" to="ReselectFlow" />
<transition on="MessageProcessingError" to="MessageProcessingError" />
<transition on="RuntimeException" to="RuntimeException" />
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/context/TokenConsumerContext.java b/sp-server-api/src/main/java/net/shibboleth/sp/context/TokenConsumerContext.java
index 693c056..2b09eff 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/context/TokenConsumerContext.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/context/TokenConsumerContext.java
@@ -27,39 +27,9 @@ import net.shibboleth.shared.primitive.StringSupport;
*/
public class TokenConsumerContext extends BaseContext {
- /** Tracking of whether transaction at agent is operating in passive mode. */
- private boolean passive;
-
/** A message ID to use for correlating responses against. */
@Nullable @NotEmpty private String messageCorrelationID;
-
- /**
- * Gets whether the agent transaction is a "passive" one, i.e., instructed not to
- * involve the UI.
- *
- * @return passive state of agent request
- */
- public boolean isPassive() {
- return passive;
- }
-
- /**
- * Gets whether the agent transaction is a "passive" one, i.e., instructed not to
- * involve the UI.
- *
- * <p>Defaults to false.</p>
- *
- * @param flag flag to set
- *
- * @return this context
- */
- @Nonnull public TokenConsumerContext setPassive(final boolean flag) {
- passive = flag;
-
- return this;
- }
-
/**
* Gets the message ID to correlate responses against.
*
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
index 92b0400..9f14159 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
@@ -140,12 +140,6 @@ public abstract class AbstractTokenConsumerResponseAction extends AbstractApplic
if (sessionData != null) {
output.addmember(ConsumerConstants.SESSION_OPAQUE).string(sessionData);
}
-
- // Signal back passive status based on original request.
- // This is more relevant for errors but for consistency...
- if (agentRequestContext.ensureSubcontext(TokenConsumerContext.class).isPassive()) {
- output.addmember(ConsumerConstants.PASSIVE).integer(1);
- }
// Issue redirect to proper resource URL. Either recovered from protocol state,
// or falling back to an input parameter from the agent. Final backtop is a relative
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookie.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookie.java
index 313260f..7e9077c 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookie.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookie.java
@@ -15,7 +15,6 @@
package net.shibboleth.sp.profile.impl;
import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
@@ -32,7 +31,6 @@ import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.net.CookieManager;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
@@ -72,22 +70,15 @@ public class IssueCorrelationCookie extends AbstractApplicationAction {
/** Lookup strategy for request message ID. */
@NonnullAfterInit private Function<ProfileRequestContext,String> requestIDLookupStrategy;
- /** Condition for deriving passive request status. */
- @Nonnull private Predicate<ProfileRequestContext> passiveRequestPredicate;
-
/** State token vakue used in cookie name. */
@NonnullBeforeExec private String stateToken;
/** Request ID. */
@NonnullBeforeExec private String requestID;
- /** Passive indicator. */
- private boolean passive;
-
/** Constructor. */
public IssueCorrelationCookie() {
cookiePrefix = DEFAULT_COOKIE_PREFIX;
- passiveRequestPredicate = PredicateSupport.alwaysFalse();
}
/**
@@ -138,19 +129,6 @@ public class IssueCorrelationCookie extends AbstractApplicationAction {
requestIDLookupStrategy = Constraint.isNotNull(strategy, "Request ID lookup strategy cannot be null");
}
- /**
- * Sets the condition for determining whether the request contains a passive indicator.
- *
- * <p>Defaults to "false".</p>
- *
- * @param condition
- */
- public void setPassiveRequestPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- checkSetterPreconditions();
-
- passiveRequestPredicate = Constraint.isNotNull(condition, "Passive request predicate cannot be null");
- }
-
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -171,9 +149,8 @@ public class IssueCorrelationCookie extends AbstractApplicationAction {
}
requestID = requestIDLookupStrategy.apply(profileRequestContext);
- passive = passiveRequestPredicate.test(profileRequestContext);
- if (requestID == null && !passive) {
+ if (requestID == null) {
log.debug("{} No request message ID available, skipping creation of correlation cookie", getLogPrefix());
return false;
}
@@ -213,12 +190,10 @@ public class IssueCorrelationCookie extends AbstractApplicationAction {
cookieManager.purgeStaleCookies(cookiePrefix);
- log.debug("{} Tracking {}passive request ID {} against RelayState token {}", getLogPrefix(),
- passive ? "" : "non-", requestID, stateToken);
+ log.debug("{} Tracking request ID {} against RelayState token {}", getLogPrefix(), requestID, stateToken);
final Escaper escaper = UrlEscapers.urlFormParameterEscaper();
- final String value = (passive ? "T:" : "F:") + escaper.escape(requestID);
- cookieManager.addCookie(cookiePrefix + escaper.escape(stateToken), value);
+ cookieManager.addCookie(cookiePrefix + escaper.escape(stateToken), escaper.escape(requestID));
} finally {
RemotedHttpServletRequestResponseContext.clearCurrent();
}
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/PrepareAgentErrorResponse.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/PrepareAgentErrorResponse.java
index fa49312..61d4a7e 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/PrepareAgentErrorResponse.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/PrepareAgentErrorResponse.java
@@ -26,10 +26,8 @@ import org.opensaml.profile.context.navigate.CurrentOrPreviousEventLookup;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.sp.context.AgentRequestContext;
-import net.shibboleth.sp.context.TokenConsumerContext;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.profile.AbstractAgentRequestAction;
-import net.shibboleth.sp.profile.ConsumerConstants;
import net.shibboleth.sp.profile.SPConstants;
/**
@@ -89,11 +87,6 @@ public class PrepareAgentErrorResponse extends AbstractAgentRequestAction {
if (target != null) {
output.addmember(SPConstants.TARGET).unsafe_string(target);
}
-
- final TokenConsumerContext tokenContext = agentContext.getSubcontext(TokenConsumerContext.class);
- if (tokenContext != null && tokenContext.isPassive()) {
- output.addmember(ConsumerConstants.PASSIVE).integer(1);
- }
}
}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookie.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookie.java
index 2e9d745..8dc0fa0 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookie.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookie.java
@@ -161,17 +161,10 @@ public class ProcessCorrelationCookie extends AbstractApplicationAction {
cookieManager.unsetCookie(cookieName);
final String decoded = URISupport.doURLDecode(value);
- if (decoded != null && decoded.startsWith("T:")) {
- agentRequestContext.ensureSubcontext(TokenConsumerContext.class).setPassive(true);
- } else if (decoded == null || !decoded.startsWith("F:")) {
- log.warn("{} Correlation cookie for state token '{}' had invalid value: ", getLogPrefix(), stateToken,
- decoded);
- return;
- }
- log.debug("{} Extracted request ID '{}' for state token '{}'", getLogPrefix(), decoded.substring(2), stateToken);
+ log.debug("{} Extracted request ID '{}' for state token '{}'", getLogPrefix(), decoded, stateToken);
- agentRequestContext.ensureSubcontext(TokenConsumerContext.class).setMessageCorrelationID(decoded.substring(2));
+ agentRequestContext.ensureSubcontext(TokenConsumerContext.class).setMessageCorrelationID(decoded);
} finally {
RemotedHttpServletRequestResponseContext.clearCurrent();
}
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookieTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookieTest.java
index 5c86d9b..85a56ee 100644
--- a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookieTest.java
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueCorrelationCookieTest.java
@@ -17,7 +17,6 @@ package net.shibboleth.sp.profile.impl;
import java.util.ArrayList;
import java.util.List;
import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
@@ -53,7 +52,6 @@ public class IssueCorrelationCookieTest extends BaseAgplicationActionTest {
@Nonnull @NotEmpty private final static String TEST_ID = "123456789";
private String requestId;
- private boolean passive;
private DDF input;
private MockHttpServletRequest request;
@@ -84,10 +82,6 @@ public class IssueCorrelationCookieTest extends BaseAgplicationActionTest {
action = new IssueCorrelationCookie();
action.setCookieManager(cookieManager);
- action.setPassiveRequestPredicate(new Predicate<>() {
- public boolean test(ProfileRequestContext t) {
- return passive;
- }});
action.setRequestIDLookupStrategy(new Function<>() {
public String apply(ProfileRequestContext t) {
return requestId;
@@ -113,20 +107,18 @@ public class IssueCorrelationCookieTest extends BaseAgplicationActionTest {
@DataProvider
Object[][] correlationData() {
return new Object[][] {
- new Object[] { null, TEST_ID, false},
- new Object[] { TEST_STATE, null, false},
- new Object[] { TEST_STATE, TEST_ID, false},
- new Object[] { TEST_STATE, TEST_ID, true},
+ new Object[] { null, TEST_ID},
+ new Object[] { TEST_STATE, null},
+ new Object[] { TEST_STATE, TEST_ID},
};
}
@Test(dataProvider="correlationData")
- public void testAction(final String state, final String id, final Boolean passiveFlag) {
- evaluateAction(state, id, passiveFlag);
+ public void testAction(final String state, final String id) {
+ evaluateAction(state, id);
}
- private void evaluateAction(final String state, final String id, final Boolean passiveFlag) {
- passive = passiveFlag;
+ private void evaluateAction(final String state, final String id) {
requestId = id;
if (state != null) {
input.addmember(SPConstants.STATE).string(state);
@@ -148,7 +140,7 @@ public class IssueCorrelationCookieTest extends BaseAgplicationActionTest {
final Cookie cookie = response.getCookie(IssueCorrelationCookie.DEFAULT_COOKIE_PREFIX + state);
assert cookie != null;
- Assert.assertEquals(cookie.getValue(), (passive ? "T:" : "F:") + requestId);
+ Assert.assertEquals(cookie.getValue(), requestId);
Assert.assertEquals(cookie.getMaxAge(), -1);
Assert.assertEquals(cookie.getAttribute("SameSite"), SameSiteValue.None.getValue());
}
@@ -163,7 +155,7 @@ public class IssueCorrelationCookieTest extends BaseAgplicationActionTest {
}
request.setCookies(cookies.toArray(new Cookie[12]));
- evaluateAction(TEST_STATE, TEST_ID, false);
+ evaluateAction(TEST_STATE, TEST_ID);
Assert.assertEquals(response.getCookies().length, 3);
}
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookieTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookieTest.java
index bb7b045..3b37c5d 100644
--- a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookieTest.java
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ProcessCorrelationCookieTest.java
@@ -101,22 +101,20 @@ public class ProcessCorrelationCookieTest extends BaseAgplicationActionTest {
@DataProvider
Object[][] correlationData() {
return new Object[][] {
- new Object[] {false, null, null, false},
- new Object[] {false, TEST_STATE, null, false},
- new Object[] {true, null, null, false},
- new Object[] {true, TEST_STATE, TEST_ID, false},
- new Object[] {true, TEST_STATE, TEST_ID, true},
+ new Object[] {false, null, null},
+ new Object[] {false, TEST_STATE, null},
+ new Object[] {true, null, null},
+ new Object[] {true, TEST_STATE, TEST_ID},
};
}
@Test(dataProvider="correlationData")
- public void testAction(final Boolean createCookie, final String token, final String id, final Boolean passiveFlag) {
+ public void testAction(final Boolean createCookie, final String token, final String id) {
state = token;
if (createCookie && token != null) {
final Escaper escaper = UrlEscapers.urlFormParameterEscaper();
- final Cookie cookie = new Cookie(IssueCorrelationCookie.DEFAULT_COOKIE_PREFIX + escaper.escape(token),
- (passiveFlag ? "T:" : "F:") + id);
+ final Cookie cookie = new Cookie(IssueCorrelationCookie.DEFAULT_COOKIE_PREFIX + escaper.escape(token), id);
request.setCookies(cookie);
}
@@ -128,7 +126,6 @@ public class ProcessCorrelationCookieTest extends BaseAgplicationActionTest {
final TokenConsumerContext tcc = arc.getSubcontext(TokenConsumerContext.class);
if (id != null) {
assert tcc != null;
- Assert.assertEquals(tcc.isPassive(), passiveFlag);
Assert.assertEquals(tcc.getMessageCorrelationID(), id);
} else {
Assert.assertNull(tcc);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list