[java-plugin-shibd-oidc] branch main updated: JSHIBDOIDC-24 - Allow isPassive in Prompt lookup
Codeberg
noreply at shibboleth.net
Mon May 11 11:09:26 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/fcfb8df950aa826dc9cbdd15f64dc156a3296a6a
The following commit(s) were added to refs/heads/main by this push:
new fcfb8df JSHIBDOIDC-24 - Allow isPassive in Prompt lookup
fcfb8df is described below
commit fcfb8df950aa826dc9cbdd15f64dc156a3296a6a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon May 11 12:09:15 2026 +0100
JSHIBDOIDC-24 - Allow isPassive in Prompt lookup
- And move test classes into the correct module
https://shibboleth.atlassian.net/browse/JSHIBDOIDC-24
---
sp-oidc-api/pom.xml | 16 +++
.../config/navigate/PromptLookupStrategy.java | 27 +++--
.../AbstractAuthenticationLookupStrategyTest.java | 2 +-
...nticationContextClassRefLookupStrategyTest.java | 2 +-
.../DisplayParameterLookupStrategyTest.java | 3 +-
.../ForceAuthnParameterLookupStrategyTest.java | 3 +-
.../config/navigate/PromptLookupStrategyTest.java | 120 +++++++++++++++++++++
.../RequestedClaimsLookupStrategyTest.java | 2 +-
.../navigate}/ResourceLookupStrategyTest.java | 4 +-
.../config/navigate}/ScopeLookupStrategyTest.java | 2 +-
.../navigate}/UiLocalesLookupStrategyTest.java | 2 +-
...romAuthenticationRequestLookupFunctionTest.java | 3 +-
12 files changed, 165 insertions(+), 21 deletions(-)
diff --git a/sp-oidc-api/pom.xml b/sp-oidc-api/pom.xml
index 26e3b02..2057fd7 100644
--- a/sp-oidc-api/pom.xml
+++ b/sp-oidc-api/pom.xml
@@ -85,6 +85,22 @@
<artifactId>mockito-core</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-testing</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>jakarta.servlet</groupId>
+ <artifactId>jakarta.servlet-api</artifactId>
+ <scope>test</scope>
+ </dependency>
+
</dependencies>
</project>
diff --git a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/config/navigate/PromptLookupStrategy.java b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/config/navigate/PromptLookupStrategy.java
index 3cfc8c4..b2b5a30 100644
--- a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/config/navigate/PromptLookupStrategy.java
+++ b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/config/navigate/PromptLookupStrategy.java
@@ -24,12 +24,14 @@ import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.Prompt;
import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.oidc.profile.OIDCInitiatorConstants;
import net.shibboleth.sp.oidc.profile.context.navigate.AbstractAgentAndRelyingPartyContextLookupFunction;
/**
- * Retrieve the Prompt parameter from the {@link DDF}.
+ * Retrieve the Prompt parameter from the {@link DDF}. If the prompt parameter is not supplied, but the isPassive
+ * parameter is set to true, then return a prompt value of "none".
*/
public class PromptLookupStrategy extends AbstractAgentAndRelyingPartyContextLookupFunction<Prompt> {
@@ -39,17 +41,26 @@ public class PromptLookupStrategy extends AbstractAgentAndRelyingPartyContextLoo
/** {@inheritDoc} */
@Nullable public Prompt apply(final MessageContext messageCtx) {
final DDF input = getDDF(messageCtx, DDFDirection.INPUT);
- if (input == null) {
+ if (input == null) {
return null;
}
final String promptFromDDF = input.getmember(OIDCInitiatorConstants.PROMPT).string();
- try {
- return Prompt.parse(promptFromDDF);
- } catch (final ParseException e) {
- // This should never happen
- log.error("Unable parse Prompt from DDF", e);
- return null;
+ if (StringSupport.trimOrNull(promptFromDDF) != null) {
+ try {
+ return Prompt.parse(promptFromDDF);
+ } catch (final ParseException e) {
+ // This should never happen
+ log.error("Unable parse Prompt from DDF", e);
+ return null;
+ }
+ }
+ // Typically a SAML setting, but if no prompt is provided we will honour the isPassive input from the Agent
+ final Integer isPassive = input.getmember(OIDCInitiatorConstants.IS_PASSIVE).integer();
+ if (isPassive != null && isPassive.equals(1)) {
+ log.trace("No explicit prompt supplied, but IsPassive is set, returning prompt=none");
+ return new Prompt(Prompt.Type.NONE);
}
+ return null;
}
}
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AbstractAuthenticationLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/AbstractAuthenticationLookupStrategyTest.java
similarity index 98%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AbstractAuthenticationLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/AbstractAuthenticationLookupStrategyTest.java
index 1a96abb..c7cba55 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AbstractAuthenticationLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/AbstractAuthenticationLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import java.nio.charset.StandardCharsets;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/AuthenticationContextClassRefLookupStrategyTest.java
similarity index 98%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/AuthenticationContextClassRefLookupStrategyTest.java
index 72d6bb6..1856fc2 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/AuthenticationContextClassRefLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/AuthenticationContextClassRefLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/DisplayParameterLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/DisplayParameterLookupStrategyTest.java
similarity index 95%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/DisplayParameterLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/DisplayParameterLookupStrategyTest.java
index 4f1a849..23c382e 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/DisplayParameterLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/DisplayParameterLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
@@ -25,7 +25,6 @@ import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
import net.shibboleth.sp.oidc.profile.OIDCInitiatorConstants;
-import net.shibboleth.sp.oidc.profile.config.navigate.DisplayParameterLookupStrategy;
import net.shibboleth.sp.profile.InitiatorConstants;
import net.shibboleth.sp.profile.SPConstants;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ForceAuthnParameterLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ForceAuthnParameterLookupStrategyTest.java
similarity index 96%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ForceAuthnParameterLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ForceAuthnParameterLookupStrategyTest.java
index 6b28231..669a96b 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ForceAuthnParameterLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ForceAuthnParameterLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import static org.testng.Assert.assertFalse;
import static org.testng.Assert.assertNotNull;
@@ -26,7 +26,6 @@ import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
import net.shibboleth.sp.oidc.profile.OIDCInitiatorConstants;
-import net.shibboleth.sp.oidc.profile.config.navigate.ForceAuthnParameterLookupStrategy;
import net.shibboleth.sp.profile.InitiatorConstants;
import net.shibboleth.sp.profile.SPConstants;
diff --git a/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/PromptLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/PromptLookupStrategyTest.java
new file mode 100644
index 0000000..dbf243f
--- /dev/null
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/PromptLookupStrategyTest.java
@@ -0,0 +1,120 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.oidc.profile.config.navigate;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+import static org.testng.Assert.assertTrue;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.openid.connect.sdk.Prompt;
+
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.sp.ddf.DDF;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
+import net.shibboleth.sp.oidc.profile.OIDCInitiatorConstants;
+import net.shibboleth.sp.profile.InitiatorConstants;
+import net.shibboleth.sp.profile.SPConstants;
+
+/**
+ * Tests for {@link PromptLookupStrategy}.
+ */
+public class PromptLookupStrategyTest extends AbstractAuthenticationLookupStrategyTest{
+
+ private PromptLookupStrategy strategy;
+
+ /** The DDF to store input parameters.*/
+ private DDF ddf;
+
+ @Override
+ @BeforeMethod
+ public void setUp() throws ComponentInitializationException {
+ super.setUp();
+ strategy = new PromptLookupStrategy();
+
+ ddf = new DDF(null).structure();
+ ddf.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
+ ddf.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
+ ddf.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
+ addDDFToAgentRequestContext(ddf);
+ }
+
+ @Test
+ public void testSuccess_PromptNone() {
+ ddf.addmember(OIDCInitiatorConstants.PROMPT).string("none");
+ final Prompt result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertTrue(result.size() == 1);
+ assertEquals(result.toString(), "none");
+ }
+
+ @Test
+ public void testSuccess_PromptLoginConsent() {
+ ddf.addmember(OIDCInitiatorConstants.PROMPT).string("login consent");
+ final Prompt result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertTrue(result.size() == 2);
+ assertEquals(result.toString(), "login consent");
+ }
+
+ @Test
+ public void testFail_PromptNoneConsent() {
+ ddf.addmember(OIDCInitiatorConstants.PROMPT).string("none consent");
+ final Prompt result = strategy.apply(mc);
+ // none and consent are incompatible and result in an error
+ assertNull(result);
+ }
+
+ @Test
+ public void testFail_BadPrompt() {
+ ddf.addmember(OIDCInitiatorConstants.PROMPT).string("bad");
+ final Prompt result = strategy.apply(mc);
+ assertNull(result);
+ }
+
+ @Test
+ public void testSuccess_NoPromptIsPassive() {
+ ddf.addmember(OIDCInitiatorConstants.IS_PASSIVE).integer(1);
+ final Prompt result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertTrue(result.size() == 1);
+ assertEquals(result.toString(), "none");
+ }
+
+ @Test
+ public void testSuccess_PromptAndIsPassive() {
+ ddf.addmember(OIDCInitiatorConstants.PROMPT).string("login consent");
+ ddf.addmember(OIDCInitiatorConstants.IS_PASSIVE).integer(1);
+ final Prompt result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ // Should favour the PROMPT input
+ assertTrue(result.size() == 2);
+ assertEquals(result.toString(), "login consent");
+ }
+
+ @Test
+ public void testSuccess_Nothing() {
+ final Prompt result = strategy.apply(mc);
+ assertNull(result);
+ }
+
+}
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/RequestedClaimsLookupStrategyTest.java
similarity index 98%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/RequestedClaimsLookupStrategyTest.java
index ac21832..bbf8d6e 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/RequestedClaimsLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ResourceLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ResourceLookupStrategyTest.java
similarity index 97%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ResourceLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ResourceLookupStrategyTest.java
index e8d4b73..beed47a 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ResourceLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ResourceLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
@@ -34,7 +34,7 @@ import net.shibboleth.sp.profile.InitiatorConstants;
import net.shibboleth.sp.profile.SPConstants;
/**
- * Tests for {@link ResourceLookupStrategyTest}.
+ * Tests for {@link ResourceLookupStrategy}.
*/
public class ResourceLookupStrategyTest extends AbstractAuthenticationLookupStrategyTest {
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ScopeLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ScopeLookupStrategyTest.java
similarity index 98%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ScopeLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ScopeLookupStrategyTest.java
index 5aca255..8d7603c 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/ScopeLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/ScopeLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/UiLocalesLookupStrategyTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/UiLocalesLookupStrategyTest.java
similarity index 97%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/UiLocalesLookupStrategyTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/UiLocalesLookupStrategyTest.java
index 7a0f4fa..7b14d94 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/UiLocalesLookupStrategyTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/config/navigate/UiLocalesLookupStrategyTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.config.navigate;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/MaxAgeFromAuthenticationRequestLookupFunctionTest.java b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/context/navigate/MaxAgeFromAuthenticationRequestLookupFunctionTest.java
similarity index 96%
rename from sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/MaxAgeFromAuthenticationRequestLookupFunctionTest.java
rename to sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/context/navigate/MaxAgeFromAuthenticationRequestLookupFunctionTest.java
index e28f472..9d4f94c 100644
--- a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/MaxAgeFromAuthenticationRequestLookupFunctionTest.java
+++ b/sp-oidc-api/src/test/java/net/shibboleth/sp/oidc/profile/context/navigate/MaxAgeFromAuthenticationRequestLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.sp.oidc.profile.impl;
+package net.shibboleth.sp.oidc.profile.context.navigate;
import static org.testng.Assert.assertEquals;
@@ -25,7 +25,6 @@ import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfigura
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.sp.context.StateDataContext;
import net.shibboleth.sp.oidc.profile.AuthenticationRequestStateData;
-import net.shibboleth.sp.oidc.profile.context.navigate.MaxAgeFromAuthenticationRequestLookupFunction;
/**
* Tests for {@link MaxAgeFromAuthenticationRequestLookupFunction}.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list