[java-plugin-shibd-oidc] 02/04: JSHIBDOIDC-27 - Add target (resource URL) to state data

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/80a22604ec27c071264ca7b3c24eaa7fd78b1b88

commit 80a22604ec27c071264ca7b3c24eaa7fd78b1b88
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed May 6 10:56:21 2026 +0100

    JSHIBDOIDC-27 - Add target (resource URL) to state data
    
    https://shibboleth.atlassian.net/browse/JSHIBDOIDC-27
---
 .../shibboleth/sp/oidc/flows/TestConstants.java    | 15 ++++++----
 .../impl/CreateAuthenticationStateData.java        | 32 +++++++++++++++++++---
 2 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java
index 2858279..f187e52 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestConstants.java
@@ -126,8 +126,10 @@ public final class TestConstants {
      * Build the authentication request state data for the given parameters. 
      * 
      * @param maxAge the maximum age of the authentication request, used for validation of the authentication response
-     * @param authTimeRequired a flag whether the authentication time is required, used for validation of the authentication response
-     * @param acrs the ACRs to request, used for validation of the authentication response. May be null if no ACRs are requested.
+     * @param authTimeRequired a flag whether the authentication time is required, used for validation of the 
+     *      authentication response
+     * @param acrs the ACRs to request, used for validation of the authentication response. May be null if no 
+     *      ACRs are requested.
      * @return
      */
     public static AuthenticationRequestStateData buildAuthenticationRequestStateData(
@@ -140,7 +142,8 @@ public final class TestConstants {
         state.setIssuer(CLIENT_ID)
             .setAuthenticationAuthority(ISSUER)
             .setResponseLocation(RESPONSE_URL)
-            .setRequestTime(Instant.now());
+            .setRequestTime(Instant.now())
+            .setRawResource(RESOURCE_URL.getBytes(StandardCharsets.UTF_8));
         
         if (acrs != null) {
             state.setAcrs(acrs);
@@ -154,8 +157,10 @@ public final class TestConstants {
      * contains important information about the authentication request.
      * 
      * @param maxAge the maximum age of the authentication request, used for validation of the authentication response
-     * @param authTimeRequired a flag whether the authentication time is required, used for validation of the authentication response
-     * @param acrs the ACRs to request, used for validation of the authentication response. May be null if no ACRs are requested.
+     * @param authTimeRequired a flag whether the authentication time is required, used for validation of the 
+     *      authentication response
+     * @param acrs the ACRs to request, used for validation of the authentication response. May be null if no 
+     *      ACRs are requested.
      * @return the authentication request state JSON for the given parameters
      * @throws URISyntaxException on error.
      */
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/CreateAuthenticationStateData.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/CreateAuthenticationStateData.java
index 790a906..2097c62 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/CreateAuthenticationStateData.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/CreateAuthenticationStateData.java
@@ -29,14 +29,18 @@ import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.sp.context.StateDataContext;
+import net.shibboleth.sp.ddf.DDF;
 import net.shibboleth.sp.profile.AbstractApplicationAction;
+import net.shibboleth.sp.profile.SPConstants;
 import net.shibboleth.sp.state.StateData;
 
 /**
  * 
- * An action that looks up {@link StateData} using a configured lookup strategy 
- * and adds it to a {@link StateDataContext} obtained from the profile request 
- * context using a configured creation strategy.
+ * An action that looks up {@link StateData} using a configured lookup strategy and adds it to a 
+ * {@link StateDataContext} obtained from the profile request context using a configured creation strategy.
+ * 
+ * <p>In addition, the target URL is pulled out of the Agent input and added to the state data, if available, or if 
+ * not, from any existing state data.</p>
  * 
  * @event {@link EventIds#INVALID_PROFILE_CTX}
  */
@@ -96,13 +100,30 @@ public class CreateAuthenticationStateData extends AbstractApplicationAction {
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-        
+                
         final StateDataContext stateDataContext = stateDataContextCreationStrategy.apply(profileRequestContext);
         
         if (stateDataContext == null) {
             log.error("{} Error creating StateDataContext", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
             return;
+        }       
+        
+        // Before we create new state data, pull out the target URL if either in exsiting state or from the Agent input
+        final DDF input = ensureAgentRequestContext().getInput();
+        
+        if (input == null) {
+            log.error("{} No input message", getLogPrefix());
+            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+            return;
+        }
+        
+        byte[] target = input.getmember(SPConstants.TARGET).unsafe_string();
+        if (target == null) {
+            final StateData oldStateData = stateDataContext.getStateData();
+            if (oldStateData != null) {
+                target = oldStateData.getRawResource();
+            }
         }
         
         final StateData stateData = stateDataLookupStrategy.apply(profileRequestContext);
@@ -113,6 +134,9 @@ public class CreateAuthenticationStateData extends AbstractApplicationAction {
             return;
         }
         
+        // Now add target to state
+        stateData.setRawResource(target);        
+       
         stateDataContext.setStateData(stateData);
         log.debug("{} Created authentication state data for preservation '{}'", getLogPrefix(), stateData);
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.