[java-plugin-shibd-oidc] 02/06: JSHIBDOIDC-22 - Store off iss, sid in opaque session data to support logout

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/JSHIBDOIDC-28
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/877df9ec5db598f35302fe1c75f4574b768d49bf

commit 877df9ec5db598f35302fe1c75f4574b768d49bf
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 17 17:37:54 2026 +0100

    JSHIBDOIDC-22 - Store off iss, sid in opaque session data to support
    logout
    
     - Add missing constants
    
    https://shibboleth.atlassian.net/browse/JSHIBDOIDC-22
---
 .../sp/oidc/profile/impl/PrepareAgentResponse.java | 35 +++++++++++++++++-----
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
index 1d65ffd..bd2cf7d 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
@@ -58,6 +58,27 @@ import net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction;
  */
 public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
     
+    /** Parameter for accessing the access_token from opaque data. */
+    @Nonnull @NotEmpty public static final String ACCESS_TOKEN_PARAM = "access_token";
+    
+    /** Parameter for accessing the refresh_token from opaque data. */
+    @Nonnull @NotEmpty public static final String REFRESH_TOKEN_PARAM = "refresh_token";
+    
+    /** Parameter for accessing the id_token from opaque data. */
+    @Nonnull @NotEmpty public static final String ID_TOKEN_PARAM = "id_token";
+    
+    /** Parameter for accessing the token_type from opaque data. */
+    @Nonnull @NotEmpty public static final String TOKEN_TYPE_PARAM = "token_type";
+    
+    /** Parameter for accessing the expires_in from opaque data. */
+    @Nonnull @NotEmpty public static final String EXPIRES_IN_PARAM = "expires_in";
+    
+    /** Parameter for accessing the scope from opaque data. */
+    @Nonnull @NotEmpty public static final String SCOPE_PARAM = "scope";
+    
+    /** Parameter for accessing the issued_token_type from opaque data. */
+    @Nonnull @NotEmpty public static final String ISSUED_TOKEN_TYPE_PARAM = "issued_token_type";
+    
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(PrepareAgentResponse.class);
     
@@ -140,7 +161,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
                 try {
                     final String refreshTokenString = refreshToken.getValue();
                     assert refreshTokenString != null;
-                    tokens.addmember("refresh_token").string(conditionallySeal(refreshTokenString));
+                    tokens.addmember(REFRESH_TOKEN_PARAM).string(conditionallySeal(refreshTokenString));
                 } catch (final DataSealerException e) {
                     log.debug("{} Error sealing refresh token for session data", getLogPrefix(), e);
                     // Is not an error, but the refresh token won't be stored.
@@ -153,7 +174,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
                 try {
                     final String accessTokenString = accessToken.getValue();
                     assert accessTokenString != null;
-                    tokens.addmember("access_token").string(conditionallySeal(accessTokenString));
+                    tokens.addmember(ACCESS_TOKEN_PARAM).string(conditionallySeal(accessTokenString));
                     accessTokenAdded = true;
                 } catch (final DataSealerException e) {
                     log.debug("{} Error sealing access token for session data", getLogPrefix(), e);
@@ -168,10 +189,10 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
                 final var localAccessToken = accessToken;
                 // Access token can not be null here.
                 assert localAccessToken != null;
-                tokens.addmember("token_type").string(localAccessToken.getType().getValue());
-                tokens.addmember("expires_in").longinteger(localAccessToken.getLifetime());
+                tokens.addmember(TOKEN_TYPE_PARAM).string(localAccessToken.getType().getValue());
+                tokens.addmember(EXPIRES_IN_PARAM).longinteger(localAccessToken.getLifetime());
                 if (localAccessToken.getScope() != null) {
-                    tokens.addmember("scope").string(localAccessToken.getScope()
+                    tokens.addmember(SCOPE_PARAM).string(localAccessToken.getScope()
                             .stream()
                             .map(String::valueOf)
                             .filter(s -> !s.isBlank())
@@ -179,7 +200,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
                             .collect(java.util.stream.Collectors.joining(" ")));
                 }
                 if (localAccessToken.getIssuedTokenType() != null) {
-                    tokens.addmember("issued_token_type")
+                    tokens.addmember(ISSUED_TOKEN_TYPE_PARAM)
                     .string(localAccessToken.getIssuedTokenType().getURI().toString());
                 }
             }
@@ -188,7 +209,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
                 final String serialisedIdToken = idToken.serialize();
                 if (serialisedIdToken != null) {
                     try {
-                        tokens.addmember("id_token").string(conditionallySeal(serialisedIdToken));
+                        tokens.addmember(ID_TOKEN_PARAM).string(conditionallySeal(serialisedIdToken));
                     } catch (final DataSealerException e) {
                         log.debug("{} Error sealing id_token for session data", getLogPrefix(), e);
                         // Is not an error, but the id_token will not be stored for later use e.g., logout

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.