[java-oidfed-common] 03/03: Properly log if the JWKSet cannot be parsed from entity statement payload.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidfed-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/f77f9c7aa85a845c525fcde1c9c3718ab0c11793

commit f77f9c7aa85a845c525fcde1c9c3718ab0c11793
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Oct 9 08:35:59 2026 +0300

    Properly log if the JWKSet cannot be parsed from entity statement payload.
---
 .../DefaultPayloadSignatureValidationCredentialResolver.java  | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
index af34685..dc7260d 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
@@ -26,6 +26,7 @@ import org.opensaml.security.credential.Credential;
 import org.slf4j.Logger;
 
 import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.jwt.SignedJWT;
 
 import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
@@ -61,9 +62,11 @@ public class DefaultPayloadSignatureValidationCredentialResolver extends BasicJO
                     "SignatureValidationKeyContainerJwtCriterion did not contain an instance of SignedJWT");
         }
         try {
-            final Map<String, Object> rawJwks = jwt.getJWTClaimsSet().getJSONObjectClaim("jwks");
+            final JWTClaimsSet claimsSet = jwt.getJWTClaimsSet();
+            final Map<String, Object> rawJwks = claimsSet.getJSONObjectClaim("jwks");
             if (rawJwks == null || rawJwks.isEmpty()) {
-                log.debug("No jwks found from the payload");
+                log.warn("No jwks found from the JWT payload of {}, issued by {}", claimsSet.getSubject(),
+                        claimsSet.getIssuer());
                 return CollectionSupport.emptyList();
             }
             final JWKSet jwks = JWKSet.parse(rawJwks);
@@ -73,6 +76,10 @@ public class DefaultPayloadSignatureValidationCredentialResolver extends BasicJO
                     .map(Credential.class::cast)
                     .toList();
             assert result != null;
+            if (result.isEmpty()) {
+                log.warn("No credentials could be parsed from jwks of {}, issued by {}", claimsSet.getSubject(),
+                        claimsSet.getIssuer());
+            }
             return result;
         } catch (final ParseException e) {
             throw new ResolverException("Could not parse JWKSet from JOSEObject", e);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.