[java-plugin-shibd-oidc] 05/05: Fix id_token extraction from session data and update test

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/2b2032832628070033a7e94e8560b4d0e8a55121

commit 2b2032832628070033a7e94e8560b4d0e8a55121
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jul 14 17:46:16 2026 +0100

    Fix id_token extraction from session data and update test
---
 .../oidc/profile/context/logic/LogoutHintActivationCondition.java   | 4 ++--
 .../src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java    | 3 ++-
 .../net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java   | 5 ++++-
 .../sp/oidc/profile/impl/ProcessLogoutInitiatorRequest.java         | 6 +++++-
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/logic/LogoutHintActivationCondition.java b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/logic/LogoutHintActivationCondition.java
index 5f60ebe..aefe8f7 100644
--- a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/logic/LogoutHintActivationCondition.java
+++ b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/logic/LogoutHintActivationCondition.java
@@ -56,11 +56,11 @@ public class LogoutHintActivationCondition implements Predicate<MessageContext>
         final OIDCLogoutRequest logoutRequest = logoutRequestLookupStrategy.apply(mc);
         if (logoutRequest == null || logoutRequest.getIdTokenHint() != null) {
             // Can't be set if there is no in progress logout request.
-            log.trace("id_token_hint already set, logout_hint is not enabled");
+            log.trace("id_token_hint already set, logout_hint disabled");
             return false;
         }
         // If there is no id_token_hint, we can try to set the logout_hint
-        log.trace("id_token_hint not set, logout_hint is enabled");
+        log.trace("id_token_hint not set, logout_hint enabled");
         return true;
     }
 
diff --git a/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java
index 0b8e957..b9120e7 100644
--- a/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java
@@ -603,7 +603,8 @@ public final class TestHelper {
         final DDF root = new DDF(null).structure();
         root.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();   
         final DDF session = root.addmember(ConsumerConstants.SESSION_OPAQUE);
-        session.addmember(tokenParam).string(idToken);
+        final DDF tokens = session.addmember("tokens");
+        tokens.addmember(tokenParam).string(idToken);
         return root;
     }
 
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
index bd2cf7d..9df2f1a 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
@@ -58,6 +58,9 @@ import net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction;
  */
 public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
     
+    /** Structure name for all tokens. */
+    @Nonnull @NotEmpty public static final String TOKEN_STRUCTURE = "tokens";
+    
     /** Parameter for accessing the access_token from opaque data. */
     @Nonnull @NotEmpty public static final String ACCESS_TOKEN_PARAM = "access_token";
     
@@ -154,7 +157,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
             final JWT idToken = tokenResponse.getOIDCTokens().getIDToken();
             
             log.debug("{} Storing id_token, access and refresh tokens in session data", getLogPrefix());
-            final DDF tokens = new DDF("tokens").structure();   
+            final DDF tokens = new DDF(TOKEN_STRUCTURE).structure();   
             
             // Add the refresh token if it exists
             if (refreshToken != null && refreshToken.getValue() != null) {
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ProcessLogoutInitiatorRequest.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ProcessLogoutInitiatorRequest.java
index 471cd68..d1c30af 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ProcessLogoutInitiatorRequest.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ProcessLogoutInitiatorRequest.java
@@ -123,7 +123,11 @@ public class ProcessLogoutInitiatorRequest extends AbstractApplicationAction {
         }
         
         // The ID Token should be in JWT compact form, but should be sealed at this stage
-        final String pickled = input.getmember(ConsumerConstants.SESSION_OPAQUE)
+        final DDF session = input.getmember(ConsumerConstants.SESSION_OPAQUE);
+        if (log.isTraceEnabled()) {
+            log.trace("SessionDate: {}", session);
+        }
+        final String pickled = session.getmember(PrepareAgentResponse.TOKEN_STRUCTURE)
                 .getmember(PrepareAgentResponse.ID_TOKEN_PARAM).string();
         if (pickled == null) {
             ActionSupport.buildEvent(profileRequestContext, EventIds.UNABLE_TO_DECODE);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.