[java-opensaml] branch main updated: Detect expired key when unsealing data.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-opensaml.

View the commit online:
https://codeberg.org/Shibboleth/java-opensaml/commit/19afb115d8bac78a4da22157bbbacd8ac3216ee5

The following commit(s) were added to refs/heads/main by this push:
     new 19afb115d Detect expired key when unsealing data.
19afb115d is described below

commit 19afb115d8bac78a4da22157bbbacd8ac3216ee5
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Tue Jul 14 13:05:29 2026 -0400

    Detect expired key when unsealing data.
---
 .../org/opensaml/storage/impl/client/ClientStorageService.java     | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/opensaml-storage-impl/src/main/java/org/opensaml/storage/impl/client/ClientStorageService.java b/opensaml-storage-impl/src/main/java/org/opensaml/storage/impl/client/ClientStorageService.java
index c1ee1373e..b20c3d155 100644
--- a/opensaml-storage-impl/src/main/java/org/opensaml/storage/impl/client/ClientStorageService.java
+++ b/opensaml-storage-impl/src/main/java/org/opensaml/storage/impl/client/ClientStorageService.java
@@ -56,6 +56,7 @@ import net.shibboleth.shared.security.DataExpiredException;
 import net.shibboleth.shared.security.DataSealer;
 import net.shibboleth.shared.security.DataSealerException;
 import net.shibboleth.shared.security.DataSealerKeyStrategy;
+import net.shibboleth.shared.security.KeyExpiredException;
 
 /**
  * Implementation of {@link org.opensaml.storage.StorageService} that stores data in-memory in a
@@ -457,8 +458,12 @@ public class ClientStorageService extends AbstractMapBackedStorageService implem
                 }
                 
                 log.debug("{} Successfully decrypted and loaded storage state from client", getLogPrefix());
+            } catch (final KeyExpiredException e) {
+                log.debug("{} Secret key used to secure data expired or missing", getLogPrefix());
+                storageObject = storeFactory.load(null, source);
+                storageObject.setDirty(true);
             } catch (final DataExpiredException e) {
-                log.debug("{} Secured data or key has expired", getLogPrefix());
+                log.debug("{} Secured data has expired", getLogPrefix());
                 storageObject = storeFactory.load(null, source);
                 storageObject.setDirty(true);
             } catch (final DataSealerException e) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.