[java-plugin-shibd] branch main updated: JSHIBD-24 - Clean up Application / RelyingPartyConfiguration relationship
Codeberg
noreply at shibboleth.net
Mon Jul 6 12:51:08 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/51afd5b83669bb05563eac2052f29382930f16f7
The following commit(s) were added to refs/heads/main by this push:
new 51afd5b JSHIBD-24 - Clean up Application / RelyingPartyConfiguration relationship
51afd5b is described below
commit 51afd5b83669bb05563eac2052f29382930f16f7
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon Jul 6 08:50:51 2026 -0400
JSHIBD-24 - Clean up Application / RelyingPartyConfiguration
relationship
https://shibboleth.atlassian.net/browse/JSHIBD-24
Implement wrapped RPC variant to forward lookups back to Application.
---
.../net/shibboleth/sp/conf/agents-system.xml | 38 ++---
.../main/java/net/shibboleth/sp/Application.java | 6 +-
.../net/shibboleth/sp/impl/BasicApplication.java | 23 ++-
.../impl/DelegatingRelyingPartyConfiguration.java | 122 +++++++++++++++
.../sp/impl/RelyingPartyConfigurationSupport.java | 170 +++++++++++++++++++++
.../sp/profile/impl/IssueDiscoveryRequest.java | 19 +--
.../sp/profile/impl/IssueDiscoveryRequestTest.java | 8 +-
7 files changed, 338 insertions(+), 48 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
index 3fb8a4d..38304b3 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
@@ -94,40 +94,40 @@
<!-- More traditional beans akin to IdP service. -->
<bean id="shibboleth.sp.DefaultSecurityConfiguration" class="org.opensaml.security.config.BasicSecurityConfiguration" />
-
- <!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
- <bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration"
- p:issuer="#{'%{sp.issuer:}'.trim()}"
- p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
- p:securityConfiguration-ref="#{'%{sp.security.config:shibboleth.sp.DefaultSecurityConfiguration}'.trim()}"
- p:profileConfigurations="#{getObject('shibboleth.sp.DefaultProfileConfigurations') ?: getObject('VerifiedProfileConfigurations')}" />
- <bean id="DefaultUnverifiedRelyingPartyConfiguration" parent="RelyingParty"
+ <!-- We set the honor-empty flag on this so that the typical case of an empty profile map is assumed to be valid. -->
+ <bean id="DefaultUnverifiedRelyingPartyConfiguration" class="net.shibboleth.sp.impl.DelegatingRelyingPartyConfiguration"
+ p:honorEmptyProfileCollection="true"
p:profileConfigurations="#{getObject('shibboleth.sp.UnverifiedProfileConfigurations') ?: getObject('UnverifiedProfileConfigurations')}" />
+ <!-- Parent bean for arbitrary instances. -->
+ <bean id="RelyingParty" abstract="true" class="net.shibboleth.sp.impl.DelegatingRelyingPartyConfiguration" />
+
<!-- Parent bean for RelyingParty overrides based on activation by name(s). -->
- <bean id="RelyingPartyByName" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byName" />
+ <bean id="RelyingPartyByName" abstract="true"
+ class="net.shibboleth.sp.impl.RelyingPartyConfigurationSupport" factory-method="byName" />
<!-- Parent bean for RelyingParty overrides based on activation by group or SAML affiliation. -->
- <bean id="RelyingPartyByGroup" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byGroup"
+ <bean id="RelyingPartyByGroup" abstract="true"
+ class="net.shibboleth.sp.impl.RelyingPartyConfigurationSupport" factory-method="byGroup"
c:resolver-ref="shibboleth.MetadataResolver" />
<!-- Parent bean for RelyingParty overrides based on activation by local containment only. -->
- <bean id="RelyingPartyByEntitiesDescriptor" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byGroup">
- <constructor-arg name="resolver"><null /></constructor-arg>
+ <bean id="RelyingPartyByEntitiesDescriptor" abstract="true"
+ class="net.shibboleth.sp.impl.RelyingPartyConfigurationSupport" factory-method="byGroup">
+ <constructor-arg name="resolver">
+ <null/>
+ </constructor-arg>
</bean>
<!-- Parent bean for RelyingParty overrides based on activation by tag. -->
- <bean id="RelyingPartyByTag" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byTag"
+ <bean id="RelyingPartyByTag" abstract="true"
+ class="net.shibboleth.sp.impl.RelyingPartyConfigurationSupport" factory-method="byTag"
c:trim="false" c:matchAll="false" />
<!-- Parent bean for RelyingParty overrides based on activation by tag. -->
- <bean id="RelyingPartyByMappedTag" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byMappedTag"
+ <bean id="RelyingPartyByMappedTag" abstract="true"
+ class="net.shibboleth.sp.impl.RelyingPartyConfigurationSupport" factory-method="byMappedTag"
c:trim="false" c:matchAll="false" />
<bean id="TagCandidate" abstract="true"
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
index 40c23c4..d5c05a3 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
@@ -27,6 +27,7 @@ import org.opensaml.profile.criterion.ProfileRequestContextCriterion;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
import net.shibboleth.idp.attribute.resolver.AttributeResolver;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.service.ReloadableService;
@@ -42,9 +43,12 @@ import net.shibboleth.sp.state.StateManager;
*
* <p>As a resolver, this interface MUST implement support for {@link ProfileRequestContextCriterion}.
* It MAY support other types.</p>
+ *
+ * <p>By exposing {@link RelyingPartyConfiguration} it acts as its own "default" instance of that interface
+ * while also implementing resolution of overrides.</p>
*/
@ThreadSafe
-public interface Application extends RelyingPartyConfigurationResolver {
+public interface Application extends RelyingPartyConfiguration, RelyingPartyConfigurationResolver {
/**
* Dedicated method to access application ID for explicitness.
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
index 4d007e4..00fcac5 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
@@ -726,12 +726,12 @@ public class BasicApplication extends BasicRelyingPartyConfiguration implements
return MoreObjects.toStringHelper(this)
.add("id", getId()).toString();
}
-
+
/**
* Subclass of default resolver that allows us to hook the configuration object getter methods to allow them to be
* inheritance-aware.
*/
- private class ApplicationAwareRelyingPartyResolver extends DefaultRelyingPartyConfigurationResolver {
+ private final class ApplicationAwareRelyingPartyResolver extends DefaultRelyingPartyConfigurationResolver {
/** {@inheritDoc} */
@Override
@@ -855,6 +855,14 @@ public class BasicApplication extends BasicRelyingPartyConfiguration implements
*/
public void setRelyingPartyConfigurations(@Nullable final Collection<? extends RelyingPartyConfiguration> configs) {
checkSetterPreconditions();
+
+ if (configs != null) {
+ configs.stream()
+ .filter(DelegatingRelyingPartyConfiguration.class::isInstance)
+ .map(DelegatingRelyingPartyConfiguration.class::cast)
+ .forEach(rpc -> {rpc.setApplication(this);});
+ }
+
relyingPartyResolver.setRelyingPartyConfigurations(configs);
}
@@ -876,6 +884,11 @@ public class BasicApplication extends BasicRelyingPartyConfiguration implements
*/
public void setUnverifiedConfiguration(@Nullable final RelyingPartyConfiguration configuration) {
checkSetterPreconditions();
+
+ if (configuration instanceof DelegatingRelyingPartyConfiguration del) {
+ del.setApplication(this);
+ }
+
relyingPartyResolver.setUnverifiedConfiguration(configuration);
}
@@ -883,8 +896,6 @@ public class BasicApplication extends BasicRelyingPartyConfiguration implements
* Set name of metric to use for counters to track use of configurations.
*
* @param name name for counter metrics
- *
- * @since 5.0.0
*/
public void setMetricName(@Nullable final String name) {
checkSetterPreconditions();
@@ -914,5 +925,5 @@ public class BasicApplication extends BasicRelyingPartyConfiguration implements
checkSetterPreconditions();
relyingPartyResolver.setEncryptionCredentials(credentials);
}
-
-}
+
+}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/DelegatingRelyingPartyConfiguration.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/DelegatingRelyingPartyConfiguration.java
new file mode 100644
index 0000000..2a7b874
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/DelegatingRelyingPartyConfiguration.java
@@ -0,0 +1,122 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.impl;
+
+import java.util.Map;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.sp.Application;
+
+/**
+ * Subclass of {@link BasicRelyingPartyConfiguration} that will handle absent settings
+ * by delegating to an injected instance of {@link Application}.
+ */
+public class DelegatingRelyingPartyConfiguration extends BasicRelyingPartyConfiguration {
+
+ /** Delegation source. */
+ @Nullable private Application application;
+
+ /** Whether to treat an empty profile configuration set as a valid outcome. */
+ private boolean honorEmptyProfileCollection;
+
+ /**
+ * Sets the {@link Application} to delegate to.
+ *
+ * @param app object to delegate to
+ */
+ public void setApplication(@Nullable final Application app) {
+ application = app;
+ }
+
+ /**
+ * Sets whether to treat an empty collection returned by {@link #getProfileConfigurations(ProfileRequestContext)}
+ * as a valid outcome, thus not forwarding the lookup on to the injected {@link Application}.
+ *
+ * <p>Defaults to false, disallowing an empty collection as an expected result.</p>
+ *
+ * @param flag flag to set
+ */
+ public void setHonorEmptyProfileCollection(final boolean flag) {
+ checkSetterPreconditions();
+ honorEmptyProfileCollection = flag;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ final String issuer = super.getIssuer(profileRequestContext);
+ if (issuer != null) {
+ return issuer;
+ } else if (application != null) {
+ return application.getIssuer(profileRequestContext);
+ } else {
+ return null;
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isDetailedErrors(@Nullable final ProfileRequestContext profileRequestContext) {
+ final boolean flag = super.isDetailedErrors(profileRequestContext);
+ if (flag) {
+ return flag;
+ } else if (application != null) {
+ return application.isDetailedErrors(profileRequestContext);
+ } else {
+ return false;
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public SecurityConfiguration getSecurityConfiguration(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+
+ final SecurityConfiguration config = super.getSecurityConfiguration(profileRequestContext);
+ if (config != null) {
+ return config;
+ } else if (application != null) {
+ return application.getSecurityConfiguration(profileRequestContext);
+ } else {
+ return null;
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nonnull @Unmodifiable @NotLive public Map<String, ProfileConfiguration> getProfileConfigurations(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+
+ final var profiles = super.getProfileConfigurations(profileRequestContext);
+ if (honorEmptyProfileCollection || !profiles.isEmpty()) {
+ return profiles;
+ } else if (application != null) {
+ return application.getProfileConfigurations(profileRequestContext);
+ } else {
+ return CollectionSupport.emptyMap();
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/RelyingPartyConfigurationSupport.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/RelyingPartyConfigurationSupport.java
new file mode 100644
index 0000000..a3d26ea
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/RelyingPartyConfigurationSupport.java
@@ -0,0 +1,170 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.impl;
+
+import java.util.Collection;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.navigate.EntityDescriptorLookupFunction;
+import org.opensaml.saml.common.profile.logic.EntityAttributesPredicate;
+import org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate;
+import org.opensaml.saml.common.profile.logic.EntityGroupNamePredicate;
+import org.opensaml.saml.metadata.resolver.MetadataResolver;
+import org.opensaml.saml.saml2.metadata.AffiliationDescriptor;
+import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+
+import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.profile.context.logic.RelyingPartyIdPredicate;
+import net.shibboleth.saml.profile.context.logic.MappedEntityAttributesPredicate;
+import net.shibboleth.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.StrategyIndirectedPredicate;
+
+/**
+ * This is a duplicate of a higher level class in order to override the "type" of the
+ * {@link RelyingPartyConfiguration} to create.
+ *
+ * // TODO: adjust the original class to support overriding type creation somehow
+ */
+public final class RelyingPartyConfigurationSupport {
+
+ /** Constructor. */
+ private RelyingPartyConfigurationSupport() {
+
+ }
+
+ /**
+ * A shorthand method for constructing a {@link RelyingPartyConfiguration} with an activation condition
+ * based on one or more relying party IDs.
+ *
+ * <p>If a single ID is supplied, then the ID is also set as the identifier for the configuration.</p>
+ *
+ * @param relyingPartyIds the relying parties for which the configuration should be active
+ *
+ * @return a default-constructed configuration with the appropriate condition set
+ */
+ @Nonnull public static RelyingPartyConfiguration byName(@Nonnull final Collection<String> relyingPartyIds) {
+
+ Constraint.isNotNull(relyingPartyIds, "Relying Party ID list cannot be null");
+
+ final DelegatingRelyingPartyConfiguration config = new DelegatingRelyingPartyConfiguration();
+ config.setActivationCondition(new RelyingPartyIdPredicate(relyingPartyIds));
+
+ final StringBuffer name = new StringBuffer("EntityNames[");
+ for (final String rpId: relyingPartyIds) {
+ name.append(rpId).append(',');
+
+ }
+ name.append(']');
+ config.setId(name.toString());
+ return config;
+ }
+
+ /**
+ * A shorthand method for constructing a {@link RelyingPartyConfiguration} with an activation condition
+ * based on one or more {@link EntitiesDescriptor} groups, and optionally via {@link AffiliationDescriptor} lookup.
+ *
+ * @param groupNames the group names
+ * @param resolver optional metadata source for affiliation lookup
+ *
+ * @return a default-constructed configuration with the appropriate condition set
+ */
+ @Nonnull public static RelyingPartyConfiguration byGroup(@Nonnull final Collection<String> groupNames,
+ @Nullable final MetadataResolver resolver) {
+ Constraint.isNotNull(groupNames, "Group name list cannot be null");
+
+ // We adapt an OpenSAML Predicate applying to an EntityDescriptor by indirecting the lookup of the
+ // EntityDescriptor to a lookup sequence of PRC -> RPC -> SAMLMetadataContext -> EntityDescriptor.
+
+ final StrategyIndirectedPredicate<ProfileRequestContext,EntityDescriptor> indirectPredicate =
+ new StrategyIndirectedPredicate<>(
+ new EntityDescriptorLookupFunction().compose(new SAMLMetadataContextLookupFunction()),
+ new EntityGroupNamePredicate(groupNames, resolver));
+
+ final DelegatingRelyingPartyConfiguration config = new DelegatingRelyingPartyConfiguration();
+ config.setActivationCondition(indirectPredicate);
+
+ final StringBuffer name = new StringBuffer("EntityGroups[");
+ for (final String group: groupNames) {
+ name.append(group).append(',');
+
+ }
+ name.append(']');
+ config.setId(name.toString());
+ return config;
+ }
+
+
+ /**
+ * A shorthand method for constructing a {@link RelyingPartyConfiguration} with an activation condition
+ * based on an {@link EntityAttributesPredicate}.
+ *
+ * @param candidates the candidate rules
+ * @param trim true iff tag values in metadata should be trimmed before comparison
+ * @param matchAll true iff all the candidate rules are required to match
+ *
+ * @return a default-constructed configuration with the appropriate condition set
+ */
+ @Nonnull public static RelyingPartyConfiguration byTag(@Nonnull final Collection<Candidate> candidates,
+ final boolean trim, final boolean matchAll) {
+ Constraint.isNotNull(candidates, "Candidate list cannot be null");
+
+ // We adapt an OpenSAML Predicate applying to an EntityDescriptor by indirecting the lookup of the
+ // EntityDescriptor to a lookup sequence of PRC -> RPC -> SAMLMetadataContext -> EntityDescriptor.
+
+ final StrategyIndirectedPredicate<ProfileRequestContext,EntityDescriptor> indirectPredicate =
+ new StrategyIndirectedPredicate<>(
+ new EntityDescriptorLookupFunction().compose(new SAMLMetadataContextLookupFunction()),
+ new EntityAttributesPredicate(candidates, trim, matchAll));
+
+ final DelegatingRelyingPartyConfiguration config = new DelegatingRelyingPartyConfiguration();
+ config.setActivationCondition(indirectPredicate);
+
+ return config;
+ }
+
+ /**
+ * A shorthand method for constructing a {@link RelyingPartyConfiguration} with an activation condition
+ * based on a {@link MappedEntityAttributesPredicate}.
+ *
+ * @param candidates the candidate rules
+ * @param trim true iff tag values in metadata should be trimmed before comparison
+ * @param matchAll true iff all the candidate rules are required to match
+ *
+ * @return a default-constructed configuration with the appropriate condition set
+ */
+ @Nonnull public static RelyingPartyConfiguration byMappedTag(@Nonnull final Collection<Candidate> candidates,
+ final boolean trim, final boolean matchAll) {
+ Constraint.isNotNull(candidates, "Candidate list cannot be null");
+
+ // We adapt an OpenSAML Predicate applying to an EntityDescriptor by indirecting the lookup of the
+ // EntityDescriptor to a lookup sequence of PRC -> RPC -> SAMLMetadataContext -> EntityDescriptor.
+
+ final StrategyIndirectedPredicate<ProfileRequestContext,EntityDescriptor> indirectPredicate =
+ new StrategyIndirectedPredicate<>(
+ new EntityDescriptorLookupFunction().compose(new SAMLMetadataContextLookupFunction()),
+ new MappedEntityAttributesPredicate(candidates, trim, matchAll));
+
+ final DelegatingRelyingPartyConfiguration config = new DelegatingRelyingPartyConfiguration();
+ config.setActivationCondition(indirectPredicate);
+
+ return config;
+ }
+
+}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequest.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequest.java
index 7e4dea8..5692b49 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequest.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequest.java
@@ -30,12 +30,9 @@ import org.slf4j.Logger;
import com.google.common.escape.Escaper;
import com.google.common.net.UrlEscapers;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
import net.shibboleth.sp.context.StateDataContext;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.messaging.RemotedHttpServletRequestResponseContext;
@@ -130,6 +127,8 @@ public class IssueDiscoveryRequest extends AbstractApplicationAction {
return false;
}
+ log.debug("{} Using discovery URL: {}", getLogPrefix(), discoveryURL);
+
issuer = issuerLookupStrategy.apply(profileRequestContext);
if (issuer == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
@@ -144,7 +143,7 @@ public class IssueDiscoveryRequest extends AbstractApplicationAction {
return false;
}
- // This is checked earlier in the flow, so can be treated as an outright error here.
+ // This is checked earlier in the flow, so absence treated as an outright error here.
returnURL = input.getmember(InitiatorConstants.DISCOVERY_RETURN_URL).string();
if (returnURL == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
@@ -204,17 +203,7 @@ public class IssueDiscoveryRequest extends AbstractApplicationAction {
/** {@inheritDoc} */
@Nullable public String apply(@Nullable final ProfileRequestContext input) {
-
- try {
- final RelyingPartyConfiguration rpConfig = ensureApplication().resolveSingle(new CriteriaSet());
- if (rpConfig != null) {
- return rpConfig.getIssuer(input);
- }
- } catch (final ResolverException e) {
- log.error("{} Error resolving RelyingPartyConfiguration", getLogPrefix(), e);
- }
-
- return null;
+ return ensureApplication().getIssuer(input);
}
}
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequestTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequestTest.java
index b009353..88f8bfd 100644
--- a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequestTest.java
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/IssueDiscoveryRequestTest.java
@@ -30,7 +30,6 @@ import com.google.common.escape.Escaper;
import com.google.common.net.UrlEscapers;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.sp.context.StateDataContext;
@@ -69,12 +68,7 @@ public class IssueDiscoveryRequestTest extends BaseApplicationActionTest {
public void setUp() throws ComponentInitializationException {
super.beforeMethod();
- BasicRelyingPartyConfiguration rpc = new BasicRelyingPartyConfiguration();
- rpc.setId("default");
- rpc.setIssuerLookupStrategy(input -> issuer);
- rpc.initialize();
-
- application.setUnverifiedConfiguration(rpc);
+ application.setIssuerLookupStrategy(input -> issuer);
application.setDiscoveryServiceLookupStrategy(input -> discoveryURL);
application.initialize();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list