[java-plugin-shibd-oidc] branch main updated: Harmonize StateContext location in the tree with the SAML SP
Codeberg
noreply at shibboleth.net
Wed May 20 15:59:37 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/1b2ffd2208f2e1f60fc8c6a42de6fb19436e8e95
The following commit(s) were added to refs/heads/main by this push:
new 1b2ffd2 Harmonize StateContext location in the tree with the SAML SP
1b2ffd2 is described below
commit 1b2ffd2208f2e1f60fc8c6a42de6fb19436e8e95
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed May 20 16:59:24 2026 +0100
Harmonize StateContext location in the tree with the SAML SP
- Which fixes an issue that the resource URL was not being taken from
the state data in the context and added to the output DDF.
---
...omAuthenticationRequestStateLookupStrategy.java | 7 +---
.../idp/flows/sp/consumer/oidc/oidc-beans.xml | 13 ++++----
.../idp/flows/sp/initiator/oidc/oidc-beans.xml | 6 ++--
.../shibboleth/idp/flows/sp/oidc-common-beans.xml | 39 ----------------------
.../flows/AbstractOIDCTokenConsumerFlowTest.java | 1 -
.../profile/impl/InitializePeerEntityContext.java | 6 ++++
6 files changed, 16 insertions(+), 56 deletions(-)
diff --git a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/navigate/NonceFromAuthenticationRequestStateLookupStrategy.java b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/navigate/NonceFromAuthenticationRequestStateLookupStrategy.java
index 0de6b58..836898a 100644
--- a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/navigate/NonceFromAuthenticationRequestStateLookupStrategy.java
+++ b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/context/navigate/NonceFromAuthenticationRequestStateLookupStrategy.java
@@ -21,7 +21,6 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
-import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -63,11 +62,7 @@ public final class NonceFromAuthenticationRequestStateLookupStrategy
if (prc == null) {
return null;
}
- final MessageContext messageContext = prc.getInboundMessageContext();
- if (messageContext == null) {
- return null;
- }
- final StateDataContext context = messageContext.getSubcontext(StateDataContext.class);
+ final StateDataContext context = prc.getSubcontext(StateDataContext.class);
if (context != null && context.getStateData()
instanceof final AuthenticationRequestStateData authnRequest) {
return authnRequest;
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
index 170e208..e5ceda3 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
@@ -35,7 +35,6 @@
class="net.shibboleth.sp.profile.impl.RecoverStateData" scope="prototype"
p:stateTokenLookupStrategy-ref="OAuthStateLookup"
p:errorFatal="true"
- p:stateDataContextCreationStrategy-ref="shibboleth.ChildLookupOrCreate.StateDataContextFromInbound"
p:stateDataClass="net.shibboleth.sp.oidc.profile.AuthenticationRequestStateData"
p:createOutputObjects="true"/>
@@ -46,7 +45,7 @@
class="net.shibboleth.sp.oidc.profile.impl.ValidateAuthenticationResponseResult" />
<bean id="InitializePeerEntityContext" class="net.shibboleth.sp.oidc.profile.impl.InitializePeerEntityContext"
- p:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromInbound"/>
+ p:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"/>
<bean id="InitializeRelyingPartyContextFromOIDCPeer"
class="net.shibboleth.sp.oidc.profile.impl.InitializeRelyingPartyContextFromOIDCPeer" scope="prototype" />
@@ -125,11 +124,11 @@
p:oAuth2ClientAuthenticationContextLookupStrategy-ref="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContextFromInboundMessageContext">
<property name="redirectUriLookupStrategy">
<bean class="net.shibboleth.sp.oidc.profile.context.navigate.RedirectUriFromStateLookupStrategy" scope="prototype"
- c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromInbound"/>
+ c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"/>
</property>
<property name="pkceCodeVerifierLookupStrategy">
<bean class="net.shibboleth.sp.oidc.profile.context.navigate.PKCECodeVerifierFromStateLookupStrategy" scope="prototype"
- c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromInbound"/>
+ c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"/>
</property>
</bean>
@@ -349,11 +348,11 @@
<bean id="AuthenticationRequestTimeLookupFunction" scope="prototype"
class="net.shibboleth.sp.oidc.profile.context.navigate.AuthenticationRequestTimeLookupFunction"
p:clockSkew="%{sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew:PT0S}"
- p:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromInbound"/>
+ p:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"/>
<bean id="DefaultAuthTimeActivationCondition" scope="prototype"
class="net.shibboleth.sp.oidc.profile.context.logic.AuthTimeRequestedActivationCondition"
- c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromInbound"/>
+ c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"/>
<bean id="ACRClaimValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ACRClaimsValidator" scope="prototype"
@@ -364,7 +363,7 @@
<bean id="DefaultRequestedACRClaimLookupStrategy" scope="prototype"
class="net.shibboleth.sp.oidc.profile.context.navigate.RequestedACRClaimsFromStateLookupStrategy"
- c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromInbound"/>
+ c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"/>
<bean id="DefaultRequestedACRValidationActivationCondition" scope="prototype"
class="net.shibboleth.sp.oidc.profile.config.logic.RequestedACRValidationActivationCondition"
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
index 9af5c0a..a681ad8 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
@@ -268,7 +268,7 @@
-->
<bean id="CreateAuthenticationStateData" class="net.shibboleth.sp.oidc.profile.impl.CreateAuthenticationStateData"
scope="prototype"
- p:stateDataContextCreationStrategy-ref="shibboleth.ChildLookupOrCreate.StateDataContextFromOutbound"
+ p:stateDataContextCreationStrategy-ref="shibboleth.ChildLookupOrCreate.StateDataContext"
p:stateDataLookupStrategy-ref="AuthenticationRequestStateForStorageStrategy"/>
<!--
@@ -287,7 +287,7 @@
<bean id="PreserveState"
class="net.shibboleth.sp.profile.PreserveStateDataAction" scope="prototype"
p:createOutputObjects="true"
- p:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromOutbound"
+ p:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"
p:errorFatal="%{sp.stateToken.errorsFatal:true}" />
<bean id="HandleOutboundMessage" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
@@ -306,7 +306,7 @@
scope="prototype">
<property name="parameterValueLookupStrategy">
<bean class="net.shibboleth.sp.oidc.messaging.context.navigate.StateTokenLookupStrategy" scope="prototype"
- c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContextFromOutbound"/>
+ c:stateDataContextLookupStrategy-ref="shibboleth.ChildLookup.StateDataContext"/>
</property>
</bean>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
index a5aa408..0894f60 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
@@ -223,45 +223,6 @@
</constructor-arg>
</bean>
- <bean id="shibboleth.ChildLookup.StateDataContextFromOutbound"
- parent="shibboleth.Functions.Compose">
- <constructor-arg name="g">
- <ref bean="shibboleth.ChildLookup.StateDataContext" />
- </constructor-arg>
- <constructor-arg name="f">
- <ref bean="shibboleth.MessageContextLookup.Outbound" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.ChildLookupOrCreate.StateDataContextFromOutbound"
- parent="shibboleth.Functions.Compose">
- <constructor-arg name="g">
- <ref bean="shibboleth.ChildLookupOrCreate.StateDataContext" />
- </constructor-arg>
- <constructor-arg name="f">
- <ref bean="shibboleth.MessageContextLookup.Outbound" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.ChildLookup.StateDataContextFromInbound"
- parent="shibboleth.Functions.Compose">
- <constructor-arg name="g">
- <ref bean="shibboleth.ChildLookup.StateDataContext" />
- </constructor-arg>
- <constructor-arg name="f">
- <ref bean="shibboleth.MessageContextLookup.Inbound" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.ChildLookupOrCreate.StateDataContextFromInbound"
- parent="shibboleth.Functions.Compose">
- <constructor-arg name="g">
- <ref bean="shibboleth.ChildLookupOrCreate.StateDataContext" />
- </constructor-arg>
- <constructor-arg name="f">
- <ref bean="shibboleth.MessageContextLookup.Inbound" />
- </constructor-arg>
- </bean>
<!-- Common Actions -->
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/AbstractOIDCTokenConsumerFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/AbstractOIDCTokenConsumerFlowTest.java
index 77a07b9..f61a494 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/AbstractOIDCTokenConsumerFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/AbstractOIDCTokenConsumerFlowTest.java
@@ -425,7 +425,6 @@ public abstract class AbstractOIDCTokenConsumerFlowTest extends AbstractSPFlowTe
@Nonnull protected DDF buildRemotedQueryStringResponse(@Nonnull final AuthorizationResponse response) {
final DDF obj = new DDF(null).structure();
- obj.addmember(ConsumerConstants.BASE_URL).unsafe_string(TestConstants.RESOURCE_URL.getBytes(StandardCharsets.UTF_8));
final DDF http = obj.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
http.addmember(RemotedHttpServletRequest.METHOD).string("GET");
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/InitializePeerEntityContext.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/InitializePeerEntityContext.java
index 7f72caf..0df32bc 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/InitializePeerEntityContext.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/InitializePeerEntityContext.java
@@ -19,6 +19,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -51,6 +52,11 @@ public class InitializePeerEntityContext extends AbstractProfileAction {
/** Strategy used to locate the {@link StateDataContext}. */
@NonnullAfterInit private Function<ProfileRequestContext,StateDataContext> stateDataContextLookupStrategy;
+ /** Constructor.*/
+ public InitializePeerEntityContext() {
+ stateDataContextLookupStrategy = new ChildContextLookup<>(StateDataContext.class);
+ }
+
/**
* Set the strategy used to locate the {@link StateDataContext} to pull the issuer out of.
*
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list