[java-plugin-shibd] branch dev/StateMgmtWIP updated: Add hook for supplying SessionNotOnOrAfter outbound from token consumer.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/StateMgmtWIP
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/fb6619a6221c7e31147ba09257523a98e1a19c53

The following commit(s) were added to refs/heads/dev/StateMgmtWIP by this push:
     new fb6619a  Add hook for supplying SessionNotOnOrAfter outbound from token consumer.
fb6619a is described below

commit fb6619a6221c7e31147ba09257523a98e1a19c53
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon May 4 14:58:01 2026 -0400

    Add hook for supplying SessionNotOnOrAfter outbound from token consumer.
---
 .../sp/profile/AbstractTokenConsumerResponseAction.java | 17 +++++++++++++++++
 .../net/shibboleth/sp/profile/ConsumerConstants.java    |  3 +++
 2 files changed, 20 insertions(+)

diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
index f841454..915a463 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
@@ -15,6 +15,7 @@
 package net.shibboleth.sp.profile;
 
 import java.nio.charset.StandardCharsets;
+import java.time.Instant;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
@@ -134,6 +135,11 @@ public abstract class AbstractTokenConsumerResponseAction extends AbstractApplic
             output.addmember(ConsumerConstants.SESSION_OPAQUE).structure().add(sessionData);
         }
         
+        final Instant overrideExp = getSessionNotOnOrAfter(profileRequestContext);
+        if (overrideExp != null) {
+            output.addmember(ConsumerConstants.SESSION_NOTONORAFTER).longinteger(overrideExp.getEpochSecond());
+        }
+        
         final RemotedHttpServletResponse remotedResponse = agentRequestContext.getRemotedHttpServletResponse();
         assert remotedResponse != null;
         
@@ -168,5 +174,16 @@ public abstract class AbstractTokenConsumerResponseAction extends AbstractApplic
      * @return opaque session data as a {@link DDF} node, or null if no session data is provided
      */
     @Nullable protected abstract DDF getSessionData(@Nonnull final ProfileRequestContext profileRequestContext);
+    
+    /**
+     * Get a timestamp for the expiration of the session directed by the authentication token, if any.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return session expiration time or null
+     */
+    @Nullable protected Instant getSessionNotOnOrAfter(@Nonnull final ProfileRequestContext profileRequestContext) {
+        return null;
+    }
 
 }
\ No newline at end of file
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/ConsumerConstants.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/ConsumerConstants.java
index 3725f85..2c903ad 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/ConsumerConstants.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/ConsumerConstants.java
@@ -32,6 +32,9 @@ public final class ConsumerConstants {
     /** Opaque session data member. */
     @Nonnull @NotEmpty public static final String SESSION_OPAQUE = "session.opaque";
 
+    /** NotOnOrAfter session member. */
+    @Nonnull @NotEmpty public static final String SESSION_NOTONORAFTER = "session.notonorafter";
+    
     /** Session attributes data member. */
     @Nonnull @NotEmpty public static final String SESSION_ATTRIBUTES = "session.attributes";
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.