[java-plugin-shibd] branch main updated: Add action for recovering resource from state token.
Scott Cantor
cantor.2 at osu.edu
Tue Sep 23 19:19:21 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=6d3ac5d427a83093b40b5243bd30e637344a4e8a
The following commit(s) were added to refs/heads/main by this push:
new 6d3ac5d Add action for recovering resource from state token.
6d3ac5d is described below
commit 6d3ac5d427a83093b40b5243bd30e637344a4e8a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 23 15:19:19 2025 -0400
Add action for recovering resource from state token.
---
.../AbstractTokenConsumerResponseAction.java | 22 ++--
.../sp/profile/impl/MapResourceToStateToken.java | 2 +-
.../sp/profile/impl/MapStateTokenToResource.java | 118 +++++++++++++++++++++
3 files changed, 131 insertions(+), 11 deletions(-)
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
index 9f14159..a762a34 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
@@ -37,7 +37,6 @@ import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.sp.context.AgentRequestContext;
-import net.shibboleth.sp.context.TokenConsumerContext;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.messaging.RemotedHttpServletRequestResponseContext;
import net.shibboleth.sp.messaging.RemotedHttpServletResponse;
@@ -175,6 +174,11 @@ public abstract class AbstractTokenConsumerResponseAction extends AbstractApplic
@Nullable protected byte[] recoverState(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AgentRequestContext agentRequestContext) {
+ // Short-circuit if already done.
+ if (agentRequestContext.getTargetURL() != null) {
+ return agentRequestContext.getTargetURL();
+ }
+
final String token = getStateToken(profileRequestContext);
if (token == null) {
log.debug("{} No state token found in protocol layer", getLogPrefix());
@@ -186,15 +190,13 @@ public abstract class AbstractTokenConsumerResponseAction extends AbstractApplic
RemotedHttpServletRequestResponseContext.loadCurrent(agentRequestContext.getRemotedHttpServletRequest(),
agentRequestContext.getRemotedHttpServletResponse());
- try {
- final byte[] url = ensureApplication().getStateTokenManager().recoverFromStateToken(
- ensureAgent(), ensureApplication(), token);
- log.debug("{} Requested resource recovered from state token: {}", getLogPrefix(), url);
- ensureAgentRequestContext().setTargetURL(url);
- return url;
- } catch (final IOException e) {
- log.warn("{} Exception recovering requested resource from state token", getLogPrefix(), e);
- }
+ final byte[] url = ensureApplication().getStateTokenManager().recoverFromStateToken(
+ ensureAgent(), ensureApplication(), token);
+ log.debug("{} Requested resource recovered from state token: {}", getLogPrefix(), url);
+ agentRequestContext.setTargetURL(url);
+ return url;
+ } catch (final IOException e) {
+ log.warn("{} Exception recovering requested resource from state token", getLogPrefix(), e);
} finally {
RemotedHttpServletRequestResponseContext.clearCurrent();
}
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/MapResourceToStateToken.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/MapResourceToStateToken.java
index a55d5f7..f8ef3a4 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/MapResourceToStateToken.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/MapResourceToStateToken.java
@@ -55,7 +55,7 @@ public class MapResourceToStateToken extends AbstractApplicationAction {
/** Agent input. */
@NonnullBeforeExec private DDF input;
- /** Remoted request structure. */
+ /** Target resource to operate on. */
@NonnullBeforeExec private byte[] target;
/**
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/MapStateTokenToResource.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/MapStateTokenToResource.java
new file mode 100644
index 0000000..408fb4f
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/MapStateTokenToResource.java
@@ -0,0 +1,118 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.profile.impl;
+
+import java.io.IOException;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.sp.context.AgentRequestContext;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequestResponseContext;
+import net.shibboleth.sp.profile.AbstractApplicationAction;
+
+/**
+ * Action that maps a state token into a target/resource URL.
+ *
+ * <p>The state token comes from a pluggable function.</p>
+ *
+ * <p>The existence of {@link AgentRequestContext#getTargetURL()} will cause the action
+ * to be skipped but the absence of a state token will not result in failure.</p>
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_MESSAGE}
+ * @event {@link EventIds#IO_ERROR}
+ */
+public class MapStateTokenToResource extends AbstractApplicationAction {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(MapStateTokenToResource.class);
+
+ /** Lookup strategy for state token. */
+ @NonnullAfterInit private Function<ProfileRequestContext,String> stateTokenLookupStrategy;
+
+ /**
+ * Sets the lookup strategy to obtain the protocol specific state token.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setStateTokenLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ checkSetterPreconditions();
+ stateTokenLookupStrategy = Constraint.isNotNull(strategy, "State token lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (stateTokenLookupStrategy == null) {
+ throw new ComponentInitializationException("State token lookup strategy cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
+ if (ensureAgentRequestContext().getTargetURL() != null) {
+ log.debug("{} Target URL already populated, skipping state token processing", getLogPrefix());
+ return false;
+ }
+
+ return true;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ final AgentRequestContext agentRequestContext = ensureAgentRequestContext();
+
+ // We do the crazy stuff to accomodate cookie-backed state management
+ // (and to get the relevant state token in the first place).
+ try {
+ RemotedHttpServletRequestResponseContext.loadCurrent(agentRequestContext.getRemotedHttpServletRequest(),
+ agentRequestContext.getRemotedHttpServletResponse());
+
+ final String token = stateTokenLookupStrategy.apply(profileRequestContext);
+ if (token == null) {
+ log.debug("{} No state token returned from lookup strategy, nothing to do", getLogPrefix());
+ return;
+ }
+
+ final byte[] target = ensureApplication().getStateTokenManager().recoverFromStateToken(
+ ensureAgent(), ensureApplication(), token);
+ agentRequestContext.setTargetURL(target);
+ log.debug("{} Requested resource recovered from state token: {}", getLogPrefix(), target);
+ } catch (final IOException e) {
+ log.warn("{} Exception recovering requested resource from state token", getLogPrefix(), e);
+ } finally {
+ RemotedHttpServletRequestResponseContext.clearCurrent();
+ }
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list