[java-opensaml] branch main updated: JSATTR-6: SAML AttributeQuery DataConnector

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-opensaml.

View the commit online:
https://codeberg.org/Shibboleth/java-opensaml/commit/13c394157baad3a8405db892deac0944c9412a08

The following commit(s) were added to refs/heads/main by this push:
     new 13c394157 JSATTR-6: SAML AttributeQuery DataConnector
13c394157 is described below

commit 13c394157baad3a8405db892deac0944c9412a08
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Tue Jan 20 22:33:55 2026 -0500

    JSATTR-6: SAML AttributeQuery DataConnector
    
    Update SAML2ObjectSupport.matchSubject(...) with new boolean arg for
    whether to process SubjectConfirmation.
---
 .../saml/saml2/profile/SAML2ObjectSupport.java     | 32 ++++++++++++++++++++--
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2ObjectSupport.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2ObjectSupport.java
index bedda0014..60d113302 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2ObjectSupport.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2ObjectSupport.java
@@ -19,6 +19,7 @@ import java.util.Objects;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.opensaml.saml.saml1.core.SubjectConfirmation;
 import org.opensaml.saml.saml2.core.BaseID;
 import org.opensaml.saml.saml2.core.EncryptedID;
 import org.opensaml.saml.saml2.core.NameID;
@@ -136,12 +137,37 @@ public final class SAML2ObjectSupport {
      * @throws IllegalArgumentException if EncryptedID or BaseID is present in either Subject instance
      */
     public static boolean matchSubject(@Nonnull final Subject target, @Nonnull final Subject control) {
+        return matchSubject(target, control, true);
+    }
+
+    /**
+     * Match a target {@link Subject} against a control instance according to the requirements specified
+     * in SAML Core 3.3.4.
+     * 
+     * <p>
+     * Any {@link EncryptedID} instances which were originally present must have already been decrypted
+     * and stored in-place on the Subject. {@link BaseID} is currently unsupported. Presence of either
+     * in either target or control subject will throw {@link IllegalArgumentException}.
+     * </p>
+     * 
+     * @param target the target subject to evaluate
+     * @param control the control subject against which to evaluate the target
+     * @param processConfirmation flag controlling whether to process matching of {@link SubjectConfirmation}
+     * 
+     * @return true if target matches the control, otherwise false
+     * 
+     * @throws IllegalArgumentException if EncryptedID or BaseID is present in either Subject instance
+     */
+    public static boolean matchSubject(@Nonnull final Subject target, @Nonnull final Subject control,
+            final boolean processConfirmation) {
         Constraint.isNotNull(target, "Target Subject was null");
         Constraint.isNotNull(control, "Control Subject was null");
         
-        //TODO implement SubjectConfirmation support. Need registry of method URI -> SC matchers
-        if (!target.getSubjectConfirmations().isEmpty()) {
-            LOG.warn("Target Subject contains SubjectConfirmation, currently not supported and eval is skipped");
+        if (processConfirmation) {
+            //TODO implement SubjectConfirmation support. Need registry of method URI -> SC matchers or similar.
+            if (!target.getSubjectConfirmations().isEmpty()) {
+                LOG.warn("Target Subject contains SubjectConfirmation, currently not supported and eval is skipped");
+            }
         }
         
         if (target.getEncryptedID() != null || control.getEncryptedID() != null) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.