[java-plugin-shibd-oidc] branch main updated: Revert validation response check

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/24b55ca72909a5c2171baafd6e08da1cb3c42673

The following commit(s) were added to refs/heads/main by this push:
     new 24b55ca  Revert validation response check
24b55ca is described below

commit 24b55ca72909a5c2171baafd6e08da1cb3c42673
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Apr 13 12:32:53 2026 +0100

    Revert validation response check
    
     - I accidently reposition the OP validation check to the start of the
    flow, thinking it was more efficient to terminate early on OP error
    response. But that prevents the state cookie from being unset, which
    could lead to state re-use.
     - So recover state and unset, then check correlation, then check
    response type requires further processing.
---
 .../net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml         | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
index 024b1d0..f8955b3 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
@@ -5,12 +5,12 @@
 
     <action-state id="DoProfileWork">
 <!--        <evaluate expression="PopulateMetricContext" />-->
-       <evaluate expression="DecodeMessage" />
-       <evaluate expression="ValidateAuthenticationResponseResult" /> <!-- TODO: If this fails the state below is not cleared! -->
+       <evaluate expression="DecodeMessage" />       
        <evaluate expression="MapStateTokenToResource" />
        <evaluate expression="ProcessCorrelationCookie"/>       
        <evaluate expression="RecoverAuthenticationState" />
-       <evaluate expression="ValidateResponseStateMatchesRequest" />       
+       <evaluate expression="ValidateResponseStateMatchesRequest" />
+       <evaluate expression="ValidateAuthenticationResponseResult" />  <!-- Needed at the end, so state is unset even if error from OP -->
        
        <evaluate expression="ProviderMetadataLookup" />        
        <evaluate expression="InitializeRelyingPartyContextFromOIDCPeer" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.