[java-plugin-shibd] 04/04: Adjust validation action for creation of "empty" RelyingPartyContext.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/e284bd2abeee69539ada9160eff7d09c4d31bfe6

commit e284bd2abeee69539ada9160eff7d09c4d31bfe6
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu Aug 6 14:33:37 2026 -0400

    Adjust validation action for creation of "empty" RelyingPartyContext.
---
 .../impl/ValidateSessionInitiatorRequest.java      | 25 +++++++++++++---------
 .../impl/ValidateSessionInitiatorRequestTest.java  | 21 ++++++++++++++++--
 2 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
index cc87c37..ec75f4a 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
@@ -46,7 +46,8 @@ import net.shibboleth.shared.logic.Constraint;
  * this is confgurable to allow session initiator flows to indicate via wiring how to handle
  * this case.</p>
  * 
- * <p>The input message is also validated to ensure any other required inputs are available.</p>
+ * <p>In the case that a relying party is identified but not required, requirng a discovery response
+ * URL is an error, as such a case would result in a loop.</p>
  * 
  * @event {@link EventIds#PROCEED_EVENT_ID}
  * @event {@link EventIds#INVALID_PROFILE_CTX}
@@ -147,7 +148,7 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
         if (requireDiscoveryURL) {
             if (StringSupport.trimOrNull(input.getmember(InitiatorConstants.DISCOVERY_RETURN_URL).string()) == null) {
                 ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
-                log.info("{} Input message missing '{}' parameter, {} flow skipped", getLogPrefix(),
+                log.info("{} Input message missing '{}' parameter, {} flow cannot run", getLogPrefix(),
                         InitiatorConstants.DISCOVERY_RETURN_URL, flowId);
                 return false;
             }
@@ -165,20 +166,24 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
             // Need it, don't have it, signal an error to drop into discovery (if configured).
             if (relyingPartyId == null) {
                 ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
-                log.debug("{} Authenticating authority unknown, {} flow skipped", getLogPrefix(), flowId);
+                log.debug("{} Authenticating authority unknown, {} flow cannot run", getLogPrefix(), flowId);
                 return false;
             }
             // Need it, got it, good.
             return true;
         } else if (relyingPartyId != null) {
-            // We don't need it, but it's there? We shouldn't be running, because a loop could result.
-            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
-            log.warn("{} Authenticating authority provided, but not expected by {} flow, loop may result",
-                    getLogPrefix(), flowId);
-            return false;
+            if (requireDiscoveryURL) {
+                // A discovery flow should never have a relying party identified, or a loop would occur.
+                ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+                log.warn("{} Authenticating authority provided, but not expected by {} flow, loop may result",
+                        getLogPrefix(), flowId);
+                return false;
+            }
+            // Don't need, but have it, that's ok.
+            return true;
         } else {
-            // Don't need it, don't have it, skip execution phase.
-            return false;
+            // Don't need it, don't have it. 
+            return true;
         }
     }
     
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequestTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequestTest.java
index 0621437..624f56c 100644
--- a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequestTest.java
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequestTest.java
@@ -98,7 +98,6 @@ public class ValidateSessionInitiatorRequestTest extends BaseApplicationActionTe
 
         final Event event = action.execute(src);
         ActionTestingSupport.assertProceedEvent(event);
-        Assert.assertNull(prc.getSubcontext(RelyingPartyContext.class));
     }
     
     @Test
@@ -123,9 +122,27 @@ public class ValidateSessionInitiatorRequestTest extends BaseApplicationActionTe
         final Event event = action.execute(src);
         ActionTestingSupport.assertProceedEvent(event);
         
-        Assert.assertNull(prc.getSubcontext(RelyingPartyContext.class));
+        final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
+        assert rpc != null;
+        Assert.assertNull(rpc.getRelyingPartyId());
     }
 
+    @Test
+    public void testAuthorityWhenNotRequired() throws ComponentInitializationException {
+        application.setAuthenticatingAuthority(TEST_VALUE);
+        createAction(false, false);
+        
+        final DDF input = new DDF(null).structure();
+        arc.setInput(input);
+
+        final Event event = action.execute(src);
+        ActionTestingSupport.assertProceedEvent(event);
+        
+        final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
+        assert rpc != null;
+        Assert.assertEquals(rpc.getRelyingPartyId(), TEST_VALUE);
+    }
+    
     @Test
     public void testFallbackAuthority() throws ComponentInitializationException {        
         application.setAuthenticatingAuthority(TEST_VALUE);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.