[java-plugin-shibd-oidc] branch main updated: Improve error event handling

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/241cea25be5ab2e88c4abb6b8f47f70fb27881e7

The following commit(s) were added to refs/heads/main by this push:
     new 241cea2  Improve error event handling
241cea2 is described below

commit 241cea25be5ab2e88c4abb6b8f47f70fb27881e7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 6 13:56:53 2026 +0000

    Improve error event handling
    
     - Add missing transitions.
---
 .../net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml        | 7 ++++++-
 .../net/shibboleth/sp/oidc/profile/impl/BuildRequestObject.java    | 5 +++--
 .../net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaims.java   | 4 ++--
 .../shibboleth/sp/oidc/profile/impl/ValidateTokenClaimsTest.java   | 4 ++--
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
index 24eb746..defda79 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-flow.xml
@@ -84,7 +84,12 @@
     <global-transitions>
         <!-- Remap some internal action errors. -->
         <transition on="InvalidCredentials" to="InvalidMessage" />
-        <transition on="InvalidToken" to="MessageProcessingError" />
+        <transition on="InvalidToken" to="MessageProcessingError" />        
+        <transition on="InvalidRequestObject" to="MessageProcessingError" />
+        <transition on="InvalidUserInfoClaims" to="MessageProcessingError" />
+        <transition on="InvalidAcessToken" to="MessageProcessingError" />
+        <transition on="InvalidIdToken" to="MessageProcessingError" />
+        <transition on="InvalidUserInfoClaims" to="MessageProcessingError" />
     </global-transitions>
     
     
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/BuildRequestObject.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/BuildRequestObject.java
index f819200..8a903a7 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/BuildRequestObject.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/BuildRequestObject.java
@@ -44,6 +44,7 @@ import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
 import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
 import net.shibboleth.oidc.profile.encoding.AuthenticationContextClassReferenceSupport;
 import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
 import net.shibboleth.profile.context.RelyingPartyContext;
@@ -245,7 +246,7 @@ public class BuildRequestObject extends AbstractProfileAction {
                 // Should never happen
                 log.error("{} Signed RequestObject requires 'iss' claim, which is currently null",
                         getLogPrefix());
-                ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+                ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
                 return;
             }
             requestObjectClaims.setIssuer(new Issuer(authnRequest.getClientID().getValue())); 
@@ -295,7 +296,7 @@ public class BuildRequestObject extends AbstractProfileAction {
         // Validate the request object
         if (!validateRequestObject(profileRequestContext, requestObjectClaims)) {
             log.error("{} RequestObject claims are not valid", getLogPrefix());
-            ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_REQUEST_OBJECT);
             return;
         }
         
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaims.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaims.java
index 35c66c3..e10a75e 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaims.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaims.java
@@ -129,7 +129,7 @@ public class ValidateTokenClaims extends AbstractProfileAction {
         final JWT token = jwtLookupStrategy.apply(profileRequestContext);
         if (token == null) {
             log.error("{} JWT was not located, nothing to validate", getLogPrefix());
-            ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
             return false;
         }
         try {
@@ -140,7 +140,7 @@ public class ValidateTokenClaims extends AbstractProfileAction {
             }
         } catch (final ParseException | JWTValidationException e) {
             log.error("{} JWT Claimset is not available", getLogPrefix(),e);
-            ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
             return false;
         }        
         return true;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaimsTest.java b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaimsTest.java
index a93cf59..c93d9ea 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaimsTest.java
+++ b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ValidateTokenClaimsTest.java
@@ -20,6 +20,7 @@ import static org.testng.Assert.assertNull;
 import java.util.Map;
 
 import org.mockito.Mockito;
+import org.opensaml.profile.action.EventIds;
 import org.springframework.webflow.execution.Event;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
@@ -27,7 +28,6 @@ import org.testng.annotations.Test;
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.jwt.PlainJWT;
 
-import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.profile.testing.ActionTestingSupport;
 import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
 import net.shibboleth.oidc.jwt.claims.JWTValidationException;
@@ -130,7 +130,7 @@ public class ValidateTokenClaimsTest extends BaseAgplicationActionTest{
         final Event event = action.execute(src);
         // null event is success.
         assertNotNull(event);
-        ActionTestingSupport.assertEvent(event, AuthnEventIds.INVALID_AUTHN_CTX);
+        ActionTestingSupport.assertEvent(event, EventIds.INVALID_MESSAGE);
     }
 
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.