[java-plugin-shibd-saml] branch main updated: Override IdP enforcement of allowed parameters.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/29d3063576f649bebbf43613a90bdfbe6a3dd20b

The following commit(s) were added to refs/heads/main by this push:
     new 29d3063  Override IdP enforcement of allowed parameters.
29d3063 is described below

commit 29d3063576f649bebbf43613a90bdfbe6a3dd20b
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Tue Jun 16 10:59:30 2026 -0400

    Override IdP enforcement of allowed parameters.
---
 .../META-INF/net.shibboleth.idp/postconfig.xml      | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 77d29c3..50d4dde 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -27,7 +27,8 @@
                                     p:allowedMethods="POST" />
                                 <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
                                     p:allowedContentTypes="application/x-www-form-urlencoded" />
-                                <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.Response" />
+                                <bean parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.Response"
+                                    p:enforceAllowedParameters="true" />
                             </list>
                         </property>
                     </bean>
@@ -48,7 +49,8 @@
                                     p:allowedMethods="POST" />
                                 <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
                                     p:allowedContentTypes="application/x-www-form-urlencoded" />
-                                <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.Response" />
+                                <bean parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.Response"
+                                    p:enforceAllowedParameters="true" />
                             </list>
                         </property>
                     </bean>
@@ -70,7 +72,8 @@
                                 <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
                                     p:allowedContentTypes="application/x-www-form-urlencoded"
                                     p:allowNullContentType="true" />
-                                <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact" />
+                                <bean parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact"
+                                    p:enforceAllowedParameters="true" />
                             </list>
                         </property>
                     </bean>
@@ -99,7 +102,8 @@
                                         <list>
                                             <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestMethodValidator"
                                                 p:allowedMethods="GET" />
-                                            <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect.RequestOrResponse" />
+                                            <bean parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect.RequestOrResponse"
+                                                p:enforceAllowedParameters="true" />
                                         </list>
                                     </property>
                                 </bean>
@@ -127,7 +131,8 @@
                                                 p:allowedMethods="POST" />
                                             <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
                                                 p:allowedContentTypes="application/x-www-form-urlencoded" />
-                                            <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.RequestOrResponse" />
+                                            <bean parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.RequestOrResponse"
+                                                p:enforceAllowedParameters="true" />
                                         </list>
                                     </property>
                                 </bean>
@@ -155,7 +160,8 @@
                                                 p:allowedMethods="POST" />
                                             <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
                                                 p:allowedContentTypes="application/x-www-form-urlencoded" />
-                                            <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.RequestOrResponse" />
+                                            <bean parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.RequestOrResponse"
+                                                p:enforceAllowedParameters="true" />
                                         </list>
                                     </property>
                                 </bean>
@@ -184,7 +190,8 @@
                                             <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
                                                 p:allowedContentTypes="application/x-www-form-urlencoded"
                                                 p:allowNullContentType="true" />
-                                            <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact" />
+                                            <bean parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact"
+                                                p:enforceAllowedParameters="true" />
                                         </list>
                                     </property>
                                 </bean>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.