[java-identity-provider] branch main updated: IDP-2408 - Distingishing OIDC login_hint from IdP session hintedName

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=3c0ac93ce9e70fe89360e5ebb7f6d3efba67adda

The following commit(s) were added to refs/heads/main by this push:
     new 3c0ac93ce IDP-2408 - Distingishing OIDC login_hint from IdP session hintedName
3c0ac93ce is described below

commit 3c0ac93ce9e70fe89360e5ebb7f6d3efba67adda
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 29 11:13:33 2025 -0400

    IDP-2408 - Distingishing OIDC login_hint from IdP session hintedName
    
    https://shibboleth.atlassian.net/browse/IDP-2408
    
    Added property to suppress use of session for this.
---
 .../net/shibboleth/idp/flows/authn/authn-beans.xml   |  4 ++--
 .../impl/ExtractActiveAuthenticationResults.java     | 20 +++++++++++++++++++-
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-beans.xml
index 1e0f5a0d2..48305cccc 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/authn-beans.xml
@@ -42,8 +42,8 @@
     </bean>
     
     <bean id="ExtractActiveAuthenticationResults"
-        class="%{idp.session.activeResultExtraction:net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults}"
-        scope="prototype" />
+        class="net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults" scope="prototype"
+        p:populateHintedNameFromSession="%{idp.session.populateHintedName:true}" />
 
     <bean id="InitializeRequestedPrincipalContext"
         class="net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext" scope="prototype"
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java
index 2efa3feca..981be6f11 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ExtractActiveAuthenticationResults.java
@@ -61,12 +61,16 @@ public class ExtractActiveAuthenticationResults extends AbstractAuthenticationAc
     /** Lookup function for SessionContext. */
     @Nonnull private Function<ProfileRequestContext,SessionContext> sessionContextLookupStrategy;
     
+    /** Whether to populate {@link AuthenticationContext#setHintedName(String)} via the session. */
+    private boolean populateHintedNameFromSession;
+    
     /** Session to copy results from. */
     @NonnullBeforeExec private IdPSession session;
     
     /** Constructor. */
     public ExtractActiveAuthenticationResults() {
         sessionContextLookupStrategy = new ChildContextLookup<>(SessionContext.class);
+        populateHintedNameFromSession = true;
     }
     
     /**
@@ -81,6 +85,20 @@ public class ExtractActiveAuthenticationResults extends AbstractAuthenticationAc
                 "SessionContext lookup strategy cannot be null");
     }
     
+    /**
+     * Set whether to populate {@link AuthenticationContext#setHintedName(String)} via the session.
+     * 
+     * <p>Defaults to true.</p>
+     * 
+     * @param flag flag to set
+     * 
+     * @since 5.2.0
+     */
+    public void setPopulateHintedNameFromSession(final boolean flag) {
+        checkSetterPreconditions();
+        populateHintedNameFromSession = flag;
+    }
+    
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -102,7 +120,7 @@ public class ExtractActiveAuthenticationResults extends AbstractAuthenticationAc
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext) {
 
-        if (authenticationContext.getHintedName() == null) {
+        if (populateHintedNameFromSession && authenticationContext.getHintedName() == null) {
             authenticationContext.setHintedName(session.getPrincipalName());
         }
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.