[java-identity-provider] branch main updated: IDP-2391 - Consent should allow varying pluggable expiration
Codeberg
noreply at shibboleth.net
Mon Jan 12 14:46:17 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/97706cbe04d46434fe0054f64081ec7f7a9b9ebf
The following commit(s) were added to refs/heads/main by this push:
new 97706cbe0 IDP-2391 - Consent should allow varying pluggable expiration
97706cbe0 is described below
commit 97706cbe04d46434fe0054f64081ec7f7a9b9ebf
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 12 09:46:01 2026 -0500
IDP-2391 - Consent should allow varying pluggable expiration
https://shibboleth.atlassian.net/browse/IDP-2391
Add a lookup strategy to compute consent record lifetime.
---
.../consent/flow/impl/ConsentFlowDescriptor.java | 42 +++++++++++++++++++---
.../storage/impl/CreateGlobalConsentResult.java | 2 +-
.../consent/flow/storage/impl/CreateResult.java | 2 +-
.../flow/impl/ConsentFlowDescriptorTest.java | 4 +--
4 files changed, 42 insertions(+), 8 deletions(-)
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptor.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptor.java
index f2b7c3e47..f77ddccd8 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptor.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptor.java
@@ -15,10 +15,16 @@
package net.shibboleth.idp.consent.flow.impl;
import java.time.Duration;
+import java.util.function.Function;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
+
import net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
/**
* Descriptor for a consent flow.
@@ -32,7 +38,7 @@ public class ConsentFlowDescriptor extends ProfileInterceptorFlowDescriptor {
private boolean compareValues;
/** Time to expire consent storage records. Default value: null/infinite. */
- @Nullable private Duration lifetime;
+ @Nullable private Function<ProfileRequestContext,Duration> lifetimeLookupStrategy;
/** Maximum number of records stored in the storage service. */
private int maxStoredRecords;
@@ -58,14 +64,30 @@ public class ConsentFlowDescriptor extends ProfileInterceptorFlowDescriptor {
}
/**
- * Time to expire consent storage records.
+ * Gets time to expire consent storage records.
*
* @return time to expire consent storage records, null for infinite.
+ *
+ * <p>This is deprecated in favor of {@link #getLifetime(ProfileRequestContext)}.</p>
+ *
+ * @deprecated
*/
+ @Deprecated(since="5.2.0", forRemoval=true)
@Nullable public Duration getLifetime() {
- return lifetime;
+ return lifetimeLookupStrategy.apply(null);
}
+ /**
+ * Gets time to expire consent storage records.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return lifetime, or null for infinite
+ */
+ @Nullable public Duration getLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+ return lifetimeLookupStrategy.apply(profileRequestContext);
+ }
+
/**
* Get the maximum number of records to keep in the storage service if the expanded size threshold is not met.
*
@@ -110,9 +132,21 @@ public class ConsentFlowDescriptor extends ProfileInterceptorFlowDescriptor {
*/
public void setLifetime(@Nullable final Duration consentLifetime) {
checkSetterPreconditions();
- lifetime = consentLifetime;
+ lifetimeLookupStrategy = FunctionSupport.constant(consentLifetime);
}
+ /**
+ * Set lookup strategy for time to expire consent storage records.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.2.0
+ */
+ public void setLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
+ checkSetterPreconditions();
+ lifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lifetime lookup strategy cannot be null");
+ }
+
/**
* Set the maximum number of records to keep in the storage service if the expanded size threshold is not met.
*
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateGlobalConsentResult.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateGlobalConsentResult.java
index a6d0ea00c..839934c80 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateGlobalConsentResult.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateGlobalConsentResult.java
@@ -59,7 +59,7 @@ public class CreateGlobalConsentResult extends AbstractConsentIndexedStorageActi
final String storageContext = getStorageContext();
final String storageKey = getStorageKey();
assert flowDescriptor!=null && storageContext!= null &&storageKey!= null;
- final Duration lifetime = flowDescriptor.getLifetime();
+ final Duration lifetime = flowDescriptor.getLifetime(profileRequestContext);
final Instant expiration;
if (lifetime == null) {
expiration = null;
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateResult.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateResult.java
index 6a7580b02..7011dc175 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateResult.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/flow/storage/impl/CreateResult.java
@@ -78,7 +78,7 @@ public class CreateResult extends AbstractConsentIndexedStorageAction {
final Map<String, Consent> currentConsents = consentContext.getCurrentConsents();
final String value = getStorageSerializer().serialize(currentConsents);
- final Duration lifetime = flowDescriptor.getLifetime();
+ final Duration lifetime = flowDescriptor.getLifetime(profileRequestContext);
final Instant expiration;
if (lifetime == null) {
expiration = null;
diff --git a/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptorTest.java b/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptorTest.java
index 9bc6f4d55..3eb1c0b75 100644
--- a/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptorTest.java
+++ b/idp-consent-impl/src/test/java/net/shibboleth/idp/consent/flow/impl/ConsentFlowDescriptorTest.java
@@ -51,11 +51,11 @@ public class ConsentFlowDescriptorTest {
@Test public void testLifetime() {
Duration lifetime = Duration.ofSeconds(1);
descriptor.setLifetime(lifetime);
- Assert.assertEquals(descriptor.getLifetime(), lifetime);
+ Assert.assertEquals(descriptor.getLifetime(null), lifetime);
lifetime = Duration.ZERO;
descriptor.setLifetime(lifetime);
- Assert.assertEquals(descriptor.getLifetime(), lifetime);
+ Assert.assertEquals(descriptor.getLifetime(null), lifetime);
}
@Test public void testMaxStoredRecords() {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list