[java-plugin-shibd-oidc] branch main updated: Add better logging when sealer is not used

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/28219ae6780d6223b3c11381656a2ae0745d417b

The following commit(s) were added to refs/heads/main by this push:
     new 28219ae  Add better logging when sealer is not used
28219ae is described below

commit 28219ae6780d6223b3c11381656a2ae0745d417b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 6 09:29:58 2026 +0000

    Add better logging when sealer is not used
    
     - Sealer should always be used unless for testing.
---
 .../impl/AuthenticationRequestStateForStorageStrategy.java       | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationRequestStateForStorageStrategy.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationRequestStateForStorageStrategy.java
index 826d115..d665b10 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationRequestStateForStorageStrategy.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationRequestStateForStorageStrategy.java
@@ -42,7 +42,11 @@ import net.shibboleth.sp.oidc.profile.AuthenticationRequestStateData;
  *  for validating the authentication response. This can be stored in a way that can be recovered later when the 
  *  response is received.
  *  
- *  <p>Importantly, if an authentication authority (relying party) is not available, or the authentication request 
+ *  <p>It is important that this information is stored in a way that is protected from modification by the client, as 
+ *  tampering with this information may allow an attacker to forge authentication responses. This is supported
+ *  using the dataSealer—which should only ever be turned off for testing and debugging.</p>
+ *  
+ *  <p>If an authentication authority is not available, or the authentication request 
  *  is not available, null will be returned. This will ultimately prevent the authentication response from being
  *  validated correctly, and the calling action may wish to terminate the authentication request before a response
  *  is made.</p>
@@ -195,8 +199,11 @@ public class AuthenticationRequestStateForStorageStrategy extends AbstractIdenti
             }
             final DataSealer localDataSealer = dataSealer;
             if (localDataSealer != null && sealState.test(prc)) {
+                log.debug("{}: Authentication request state was sealed", getId());
                 return localDataSealer.wrap(serializedState);
             } else {
+                log.warn("{}: Authentication request state was NOT sealed, either DataSealer is not configured or "
+                        + "sealing predicate returned false. Sealing should be enabled in production", getId());
                 return serializedState;
             }
         } catch (final JsonProcessingException | DataSealerException e) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.