[java-plugin-shibd-oidc] branch main updated: Add no id_token logout flow test

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/ea2e842621874d8f667f22b59e7002465cfd5c77

The following commit(s) were added to refs/heads/main by this push:
     new ea2e842  Add no id_token logout flow test
ea2e842 is described below

commit ea2e842621874d8f667f22b59e7002465cfd5c77
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jul 15 09:52:30 2026 +0100

    Add no id_token logout flow test
---
 .../net/shibboleth/sp/oidc/testing/TestHelper.java   |  2 +-
 .../sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java   | 20 ++++++++++++++++++++
 .../sp/oidc/profile/impl/PrepareAgentResponse.java   | 12 ++++++------
 3 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java
index b9120e7..2cdc89b 100644
--- a/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/testing/TestHelper.java
@@ -598,7 +598,7 @@ public final class TestHelper {
      * @param tokenParam the name of the token param
      * @return the constructed DDF
      */
-    @Nonnull public static DDF buildLogoutInitiatorDDFInput(@Nonnull final String idToken, 
+    @Nonnull public static DDF buildLogoutInitiatorDDFInput(@Nullable final String idToken, 
             @Nonnull final String tokenParam) {
         final DDF root = new DDF(null).structure();
         root.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();   
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java
index 46d39c6..7f3b9db 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCLogoutInitiatorFlowTest.java
@@ -46,6 +46,7 @@ import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
 
+import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.spring.IdPPropertiesApplicationContextInitializer;
 import net.shibboleth.idp.test.PreferFileSystemApplicationContextInitializer;
 import net.shibboleth.oidc.security.credential.JWKCredential;
@@ -187,6 +188,25 @@ public class OIDCLogoutInitiatorFlowTest extends AbstractSPFlowTest {
         
     }
     
+    @Test
+    public void testRPInitiated_Failure_NoIDToken() throws Exception {
+        setDefaultAuth();
+        
+        final DDF input = 
+                TestHelper.buildLogoutInitiatorDDFInput(null, PrepareAgentResponse.ID_TOKEN_PARAM);
+        // Add target
+        input.addmember(SPConstants.TARGET).unsafe_string("https://sp.example.org/logout-end".getBytes(StandardCharsets.UTF_8));
+        setApplicationRequest(TestConstants.APPLICATION_ID_POST_LOGOUT_REDIRECT, input);
+        
+        
+                
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertFlowExecutionResult(result, FLOW_ID);
+        assertFlowExecutionOutcome(result.getOutcome());
+        assertOutputMessageEvent(result, AuthnEventIds.NO_POTENTIAL_FLOW);
+        
+    }
+    
     /**
      * Mock OpenID Provider configuration (metadata) endpoint.
      * 
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
index 9df2f1a..cea5e4c 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
@@ -148,7 +148,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
 
     /** {@inheritDoc} */
     @Override
-    protected DDF getSessionData(final ProfileRequestContext profileRequestContext) {
+    protected DDF getSessionData(@Nonnull final ProfileRequestContext profileRequestContext) {
         
         final OIDCTokenResponse tokenResponse = tokenResponseContext.getTokenResponse();
         if (tokenResponse != null) {
@@ -166,8 +166,8 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
                     assert refreshTokenString != null;
                     tokens.addmember(REFRESH_TOKEN_PARAM).string(conditionallySeal(refreshTokenString));
                 } catch (final DataSealerException e) {
-                    log.debug("{} Error sealing refresh token for session data", getLogPrefix(), e);
-                    // Is not an error, but the refresh token won't be stored.
+                    log.trace("{} Error sealing refresh token for session data", getLogPrefix(), e);
+                    // The refresh token won't be stored.
                 }
                
             }
@@ -180,8 +180,8 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
                     tokens.addmember(ACCESS_TOKEN_PARAM).string(conditionallySeal(accessTokenString));
                     accessTokenAdded = true;
                 } catch (final DataSealerException e) {
-                    log.debug("{} Error sealing access token for session data", getLogPrefix(), e);
-                    // Is not an error,  but the access token and its attributes won't be stored.
+                    log.trace("{} Error sealing access token for session data", getLogPrefix(), e);
+                    // The access token and its attributes won't be stored.
                 }
                 
             }
@@ -226,7 +226,7 @@ public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
     }
     
     /**
-     * If the data sealer is configured, use it to seal the token value. If configured to, failure to seal a token 
+     * If the data sealer is configured, use it to seal the token value. If configured, failure to seal a token 
      * results in an exception being thrown. If a sealer is not configured, the token is passed back untouched.
      * 
      * @param token the token to seal or pass through

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.