[java-oidfed-common] 02/03: Improve content checking for entity configuration and signed keysets before publishing

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidfed-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/f17c3cc6fa300ea9c471e1f295f359675106411d

commit f17c3cc6fa300ea9c471e1f295f359675106411d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Oct 9 08:19:40 2026 +0300

    Improve content checking for entity configuration and signed keysets before publishing
    
    - Verify that jwks-claim has content
    - Sub/iss match for entity configuration
---
 .../profile/impl/AbstractBuildEntityStatementAction.java     | 11 +++++++++++
 .../oidfed/profile/impl/BuildEntityConfiguration.java        | 12 ++++++++++--
 .../impl/InitializeEntityStatementContextForKeyset.java      | 12 +++++++++++-
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/AbstractBuildEntityStatementAction.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/AbstractBuildEntityStatementAction.java
index d9f98fb..1b90f93 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/AbstractBuildEntityStatementAction.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/AbstractBuildEntityStatementAction.java
@@ -48,6 +48,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.security.IdentifierGenerationStrategy;
 import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
 
@@ -223,7 +224,17 @@ public abstract class AbstractBuildEntityStatementAction extends AbstractProfile
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
         final String issuer = issuerLookupStrategy.apply(profileRequestContext);
+        if (StringSupport.trimOrNull(issuer) == null) {
+            log.error("{} Could not resolve issuer value", getLogPrefix());
+            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+            return;
+        }
         final String subject = subjectLookupStrategy.apply(profileRequestContext);
+        if (StringSupport.trimOrNull(subject) == null) {
+            log.error("{} Could not resolve subject value", getLogPrefix());
+            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+            return;
+        }
 
         final Instant now = Instant.now();
 
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/BuildEntityConfiguration.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/BuildEntityConfiguration.java
index ad6b778..bff0569 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/BuildEntityConfiguration.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/BuildEntityConfiguration.java
@@ -171,14 +171,22 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
                 final JWK jwk = CredentialConversionUtil.credentialToKey(credential);
                 if (jwk != null) {
                     jwks.add(jwk);
-                    log.debug("{} Included {} to the keyset", getLogPrefix(), jwk.toJSONString());
+                    log.debug("{} Included {} to the entity configuration keyset", getLogPrefix(), jwk.toJSONString());
+                } else {
+                    log.warn("{} Could not convert the credential {} (type {}) into a JWK", getLogPrefix(),
+                            credential.getKeyNames(), credential.getCredentialType());
                 }
             }
         }
+        if (jwks.isEmpty()) {
+            log.error("{} No credentials to publish resolved for entity configuration", getLogPrefix());
+            ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+            return false;
+        }
 
         final Duration lifetime = entityConfigurationLifetimeLookupStrategy.apply(profileRequestContext);
         if (lifetime == null) {
-            log.error("{} No lifetime supplied for entity statement", getLogPrefix());
+            log.error("{} No lifetime supplied for entity configuration", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
             return false;
         }
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java
index 22e49e7..ebc6241 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java
@@ -16,6 +16,7 @@ package net.shibboleth.oidfed.profile.impl;
 
 import java.util.Collections;
 import java.util.List;
+import java.util.Objects;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
@@ -28,6 +29,7 @@ import org.opensaml.security.config.SecurityConfiguration;
 import org.opensaml.security.credential.Credential;
 import org.slf4j.Logger;
 
+import com.nimbusds.jose.jwk.JWK;
 import com.nimbusds.jose.jwk.JWKSet;
 
 import net.shibboleth.idp.profile.AbstractProfileAction;
@@ -181,7 +183,15 @@ public class InitializeEntityStatementContextForKeyset extends AbstractProfileAc
         }
 
         final JWKSet jwks = new JWKSet(credentialsToPublish.stream()
-                .map(credential -> CredentialConversionUtil.credentialToKey(credential))
+                .map(credential -> { 
+                    final JWK jwk = CredentialConversionUtil.credentialToKey(credential);
+                    if (jwk == null) {
+                        log.warn("{} Could not convert the credential {} (type {}) into a JWK", getLogPrefix(),
+                                credential.getKeyNames(), credential.getCredentialType());
+                    }
+                    return jwk;
+                })
+                .filter(Objects::nonNull)
                 .toList());
         log.trace("{} Resolved jwks to set in the content: {}", getLogPrefix(), jwks);
         entityStatementCtx.setKeys(jwks);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.