[java-plugin-shibd] branch main updated: Add StateData recovery action.
Codeberg
noreply at shibboleth.net
Thu Apr 23 16:23:27 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/05d68d508956c78414514cafc6d06dc7c2e4981f
The following commit(s) were added to refs/heads/main by this push:
new 05d68d5 Add StateData recovery action.
05d68d5 is described below
commit 05d68d508956c78414514cafc6d06dc7c2e4981f
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu Apr 23 12:23:15 2026 -0400
Add StateData recovery action.
---
.../sp/profile/PreserveStateDataAction.java | 28 +++-
.../sp/profile/impl/RecoverStateData.java | 173 +++++++++++++++++++++
2 files changed, 200 insertions(+), 1 deletion(-)
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/PreserveStateDataAction.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/PreserveStateDataAction.java
index a556081..f381812 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/PreserveStateDataAction.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/PreserveStateDataAction.java
@@ -15,9 +15,11 @@
package net.shibboleth.sp.profile;
import java.io.IOException;
+import java.util.function.Function;
import javax.annotation.Nonnull;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -25,6 +27,7 @@ import org.slf4j.Logger;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.sp.context.AgentRequestContext;
import net.shibboleth.sp.context.StateDataContext;
@@ -57,12 +60,32 @@ public class PreserveStateDataAction extends AbstractApplicationAction {
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(PreserveStateDataAction.class);
+ /** Strategy used to create the {@link StateDataContext} to populate. */
+ @Nonnull private Function<ProfileRequestContext,StateDataContext> stateDataContextLookupStrategy;
+
/** Whether an error constructing a state token is fatal. */
private boolean errorFatal;
/** Context to operate on. */
@NonnullBeforeExec private StateDataContext stateDataContext;
+ /** Constructor. */
+ public PreserveStateDataAction() {
+ stateDataContextLookupStrategy = new ChildContextLookup<>(StateDataContext.class);
+ }
+
+ /**
+ * Sets the strategy used to lookup the {@link StateDataContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setStateDataContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,StateDataContext> strategy) {
+ checkSetterPreconditions();
+ stateDataContextLookupStrategy =
+ Constraint.isNotNull(strategy, "StateDataContext creation strategy cannot be null");
+ }
+
/**
* Sets whether an error computing a state token should result in a fatal event.
*
@@ -83,7 +106,7 @@ public class PreserveStateDataAction extends AbstractApplicationAction {
return false;
}
- stateDataContext = profileRequestContext.getSubcontext(StateDataContext.class);
+ stateDataContext = stateDataContextLookupStrategy.apply(profileRequestContext);
if (stateDataContext == null || stateDataContext.getStateData() == null) {
log.debug("{} No StateData found, skipping action", getLogPrefix());
return false;
@@ -99,6 +122,9 @@ public class PreserveStateDataAction extends AbstractApplicationAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ // In case any cookies are purged by preservation step.
+ ensureOutputObjects();
+
final AgentRequestContext agentRequestContext = ensureAgentRequestContext();
// We do the crazy stuff to accomodate cookie-backed state management.
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/RecoverStateData.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/RecoverStateData.java
new file mode 100644
index 0000000..449e6ea
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/RecoverStateData.java
@@ -0,0 +1,173 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.profile.impl;
+
+import java.io.IOException;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.sp.context.AgentRequestContext;
+import net.shibboleth.sp.context.StateDataContext;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequestResponseContext;
+import net.shibboleth.sp.profile.AbstractApplicationAction;
+import net.shibboleth.sp.state.StateData;
+
+/**
+ * Action that maps a state token into a {@link StateData} (or subclass) object.
+ *
+ * <p>The state token comes from a pluggable function but its absence will not result
+ * in failure.</p>
+ *
+ * <p>The token and the recovered object will be set into a {@link StateDataContext}
+ * created by a pluggable strategy.</p>
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @event {@link EventIds#IO_ERROR}
+ *
+ * @post a {@link StateDataContext} is created and populated as directed
+ */
+public class RecoverStateData extends AbstractApplicationAction {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(RecoverStateData.class);
+
+ /** Strategy used to create the {@link StateDataContext} to populate. */
+ @Nonnull private Function<ProfileRequestContext,StateDataContext> stateDataContextCreationStrategy;
+
+ /** Lookup strategy for state token. */
+ @NonnullAfterInit private Function<ProfileRequestContext,String> stateTokenLookupStrategy;
+
+ /** Specific class to be recovered. */
+ @Nonnull private Class<? extends StateData> stateDataClass;
+
+ /** State token returned by lookup function. */
+ @NonnullBeforeExec private String stateToken;
+
+ /** Constructor. */
+ public RecoverStateData() {
+ stateDataContextCreationStrategy = new ChildContextLookup<>(StateDataContext.class, true);
+ stateDataClass = StateData.class;
+ }
+
+ /**
+ * Sets the lookup strategy to obtain the protocol specific state token.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setStateTokenLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ checkSetterPreconditions();
+ stateTokenLookupStrategy = Constraint.isNotNull(strategy, "State token lookup strategy cannot be null");
+ }
+
+ /**
+ * Sets the strategy used to create the {@link StateDataContext}.
+ *
+ * @param strategy creation strategy
+ */
+ public void setStateDataContextCreationStrategy(
+ @Nonnull final Function<ProfileRequestContext,StateDataContext> strategy) {
+ checkSetterPreconditions();
+ stateDataContextCreationStrategy =
+ Constraint.isNotNull(strategy, "StateDataContext creation strategy cannot be null");
+ }
+
+ /**
+ * Sets the type of {@link StateData} subclass to recover from the state token.
+ *
+ * @param type subtype to recover
+ */
+ public void setStateDataClass(@Nonnull final Class<? extends StateData> type) {
+ checkSetterPreconditions();
+ stateDataClass = Constraint.isNotNull(type, "StateData class type cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (stateTokenLookupStrategy == null) {
+ throw new ComponentInitializationException("State token lookup strategy cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
+ stateToken = stateTokenLookupStrategy.apply(profileRequestContext);
+ if (stateToken == null) {
+ log.debug("{} No state token returned from lookup strategy, nothing to do", getLogPrefix());
+ return false;
+ }
+
+ return true;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ // In case any cookies are purged by recovery step.
+ ensureOutputObjects();
+
+ final AgentRequestContext agentRequestContext = ensureAgentRequestContext();
+
+ final StateDataContext stateDataContext = stateDataContextCreationStrategy.apply(profileRequestContext);
+ if (stateDataContext == null) {
+ log.error("{} Error creating StateDataContext", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return;
+ }
+
+ // We do the crazy stuff to accomodate cookie-backed state management
+ // (and to get the relevant state token in the first place).
+ try {
+ RemotedHttpServletRequestResponseContext.loadCurrent(agentRequestContext.getRemotedHttpServletRequest(),
+ agentRequestContext.getRemotedHttpServletResponse());
+
+ final StateData stateData = ensureApplication().getStateManager().recoverFromStateToken(
+ ensureAgent(), ensureApplication(), stateToken, stateDataClass);
+
+ if (stateData != null) {
+ stateDataContext.setStateData(stateData);
+ log.debug("{} State data recovered from token: {}", getLogPrefix(), stateToken);
+ } else {
+ log.warn("{} Unable to recover data from state token", getLogPrefix());
+ }
+ } catch (final IOException e) {
+ log.warn("{} Exception recovering data from state token", getLogPrefix(), e);
+ } finally {
+ RemotedHttpServletRequestResponseContext.clearCurrent();
+ }
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list