[java-plugin-shibd] 02/03: Allow for indirect usernames when validating agent credentials.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/1c271a89ec2ce0b19b29133031a6851017ff7c5f

commit 1c271a89ec2ce0b19b29133031a6851017ff7c5f
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon Nov 2 10:14:18 2026 -0500

    Allow for indirect usernames when validating agent credentials.
---
 .../sp/authn/impl/ValidateAgentCredentials.java     | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
index 616bd5b..631b21b 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
@@ -16,6 +16,7 @@ package net.shibboleth.sp.authn.impl;
 
 import java.time.Duration;
 import java.time.Instant;
+import java.util.Set;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
@@ -94,19 +95,27 @@ public class ValidateAgentCredentials extends ValidateCredentials {
 
         final AgentRequestContext agentCtx = agentRequestContextLookupStrategy.apply(profileRequestContext);
         final Agent agent = agentCtx != null ? agentCtx.getAgent() : null;
-        final String id = agent != null ? agent.getId() : null;
-        if (id == null || !subject.getPrincipals(UsernamePrincipal.class).contains(new UsernamePrincipal(id))) {
-            throw new IllegalStateException("Agent authentication result did not produce the expected results.");
+        if (agent == null) {
+            throw new IllegalStateException("Agent missing from context.");
+        }
+
+        final Set<UsernamePrincipal> usernamePrincipals = subject.getPrincipals(UsernamePrincipal.class);
+        if (usernamePrincipals == null || usernamePrincipals.size() != 1) {
+            throw new IllegalStateException("Zero or multiple UsernamePrincipals found in Subject.");
+        }
+        final UsernamePrincipal principal = usernamePrincipals.iterator().next();
+        if (!principal.getName().equals(agent.getId()) && !agent.getCredentials().containsKey(principal.getName())) {
+            throw new IllegalStateException("Agent authentication did not produce a matching UsernamePrincipal.");
         }
         
-        assert agent != null;
-        if (agent.isSupportsCachedAuthentication()) {
+        final String agentID = agent.getId();
+        if (agentID != null && agent.isSupportsCachedAuthentication()) {
             final HttpServletRequest request = getHttpServletRequest();
             final HttpSession session = request != null ? request.getSession(true) : null;
             final String address = request != null ? HttpServletSupport.getRemoteAddr(request) : null;
             if (session != null && address != null) {
                 session.setAttribute(ValidateCachedAuthentication.AGENT_SESSION_ATTRIBUTE,
-                        new CachedAgentAuthentication(id, address, Instant.now().plus(cacheDuration)));
+                        new CachedAgentAuthentication(agentID, address, Instant.now().plus(cacheDuration)));
             } else {
                 log.warn("{} No session or client address available, skipping authentication caching", getLogPrefix());
             }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.