[java-idp-plugin-oidc-op-oidfed] 02/03: Verify that the resolved provider metadata issuer matches with the federation entity

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/bb59f81be4ae0e4e5e4f47c21e6125f2dbc59744

commit bb59f81be4ae0e4e5e4f47c21e6125f2dbc59744
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Oct 1 15:18:40 2026 +0300

    Verify that the resolved provider metadata issuer matches with the federation entity
    
    Also set the initial profile configuration back after provider metadata resolution has been performed
---
 ...tadataEntityConfigurationMetadataDecorator.java | 32 ++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ProviderMetadataEntityConfigurationMetadataDecorator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ProviderMetadataEntityConfigurationMetadataDecorator.java
index 2a8ea0b..2d00b20 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ProviderMetadataEntityConfigurationMetadataDecorator.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ProviderMetadataEntityConfigurationMetadataDecorator.java
@@ -33,6 +33,7 @@ import net.shibboleth.oidfed.profile.EntityConfigurationMetadataDecorator;
 import net.shibboleth.oidfed.profile.impl.EntityStatementContext;
 import net.shibboleth.profile.config.ProfileConfiguration;
 import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
 import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
@@ -40,6 +41,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.ConstraintViolationException;
 import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.resolver.ResolverException;
 
 /**
@@ -65,6 +67,9 @@ public class ProviderMetadataEntityConfigurationMetadataDecorator extends Abstra
     /** Strategy used to locate the relying party context. */
     @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
 
+    /** Strategy used to obtain the issuer value to be matched against the provider metadata issuer. */
+    @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
     /**
      * Constructor.
      */
@@ -78,6 +83,7 @@ public class ProviderMetadataEntityConfigurationMetadataDecorator extends Abstra
                 new ChildContextLookup<>(RelyingPartyContext.class, false);
         assert rpcls != null;
         relyingPartyContextLookupStrategy = rpcls;
+        issuerLookupStrategy = new IssuerLookupFunction();
     }
     
     /**
@@ -114,6 +120,17 @@ public class ProviderMetadataEntityConfigurationMetadataDecorator extends Abstra
                 "RelyingPartyContext lookup strategy cannot be null");
     }
 
+    /**
+     * Set the strategy used to locate the issuer value to match against provider metadata issuer.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+        checkSetterPreconditions();
+
+        issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+    }
+
     /** {@inheritDoc} */
     @Override
     protected void doInitialize() throws ComponentInitializationException {
@@ -133,6 +150,11 @@ public class ProviderMetadataEntityConfigurationMetadataDecorator extends Abstra
             log.error("Metadata {} nor profile request context {} cannot be null", metadata, profileRequestContext);
             throw new ConstraintViolationException("Metadata nor profile request context cannot be null");
         }
+        final String issuer = StringSupport.trimOrNull(issuerLookupStrategy.apply(profileRequestContext));
+        if (issuer == null) {
+            log.error("Could not resolve issuer value to match against the provider metadata");
+            return;
+        }
         final EntityStatementContext entityStatementCtx =
                 entityStatementContextLookupStrategy.apply(profileRequestContext);
         if (entityStatementCtx == null) {
@@ -144,6 +166,7 @@ public class ProviderMetadataEntityConfigurationMetadataDecorator extends Abstra
             log.error("Unable to find relying party configuration");
             return;
         }
+        final ProfileConfiguration initialProfileConfiguration = relyingPartyCtx.getProfileConfig();
         final RelyingPartyConfiguration rpConfig = relyingPartyCtx.getConfiguration();
         assert rpConfig != null;
         final ProfileConfiguration profileConfiguration = rpConfig.getProfileConfiguration(profileRequestContext,
@@ -159,11 +182,20 @@ public class ProviderMetadataEntityConfigurationMetadataDecorator extends Abstra
         } catch (final ResolverException e) {
             log.error("Could not resolve provider metadata", e);
             return;
+        } finally {
+            // set back the initial profile configuration
+            relyingPartyCtx.setProfileConfig(initialProfileConfiguration);
         }
         if (providerMetadata == null) {
             log.error("Could not resolve provider metadata");
             return;
         }
+        final String metadataIssuer = providerMetadata.getIssuer().getValue();
+        if (!issuer.equals(metadataIssuer)) {
+            log.warn("Ignoring provider metadata: issuer {} does not match with the expected issuer {}",
+                    metadataIssuer, issuer);
+            return;
+        }
         log.trace("Resolved openid_provider metadata {}", providerMetadata.toJSONObject());
         if (metadata.containsKey("openid_provider")) {
             metadata.get("openid_provider").putAll(providerMetadata.toJSONObject());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.