[java-shib-profile] branch main updated: JSPROF-17 - BaseCriteriaRelyingPartyConfigurationResolver issue

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-shib-profile.

View the commit online:
https://codeberg.org/Shibboleth/java-shib-profile/commit/91c52d05e19e55767b711d43ec37f6692315458a

The following commit(s) were added to refs/heads/main by this push:
     new 91c52d0  JSPROF-17 - BaseCriteriaRelyingPartyConfigurationResolver issue
91c52d0 is described below

commit 91c52d05e19e55767b711d43ec37f6692315458a
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon Oct 12 13:44:12 2026 -0400

    JSPROF-17 - BaseCriteriaRelyingPartyConfigurationResolver issue
    
    https://shibboleth.atlassian.net/browse/JSPROF-17
    
    Added logic to inject a VerifiedProfileCriterion when warranted.
    Also adjusted the old "mocking" logic in the RP resolver.
---
 ...BaseCriteriaRelyingPartyConfigurationResolver.java | 19 ++++++++++++++++++-
 .../DefaultRelyingPartyConfigurationResolver.java     |  9 +++++----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/BaseCriteriaRelyingPartyConfigurationResolver.java b/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/BaseCriteriaRelyingPartyConfigurationResolver.java
index 751d1ff..b42fc9d 100644
--- a/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/BaseCriteriaRelyingPartyConfigurationResolver.java
+++ b/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/BaseCriteriaRelyingPartyConfigurationResolver.java
@@ -30,6 +30,7 @@ import org.slf4j.Logger;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
 import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.profile.relyingparty.VerifiedProfileCriterion;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.Pair;
@@ -113,6 +114,23 @@ public abstract class BaseCriteriaRelyingPartyConfigurationResolver<ReturnType>
         
         final CriteriaSet prcSet = new CriteriaSet(new ProfileRequestContextCriterion(prc));
         
+        // This is *extremely* non-ideal, but there's a disconnect in that the "new" way the IdP
+        // components establish whether a request is in the context of a "verified" profile is with
+        // an explicit criterion that can't be supplied by, e.g., OpenSAML components.
+        
+        // Generally those components supply only a RoleDescriptorCriterion because that's all they
+        // know, and they expect the PRC to be mocked up below. If an actual PRC showed up, we can let
+        // that pass, but if not, we have to more or less assume the request is "verified" because the
+        // calling "context" is that metadata is required to operate.
+        
+        // So we supplant what we're creating here by also adding in the expected Criterion if we spot
+        // the verified flag set in the input tree, much as happens if we created it below.
+        
+        final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
+        if (rpc != null && rpc.isVerified()) {
+            prcSet.add(new VerifiedProfileCriterion(true));
+        }
+        
         try (final ServiceableComponent<RelyingPartyConfigurationResolver> resolver =
                 rpcResolver.getServiceableComponent()) {
             return new Pair<>(resolver.getComponent().resolveSingle(prcSet), prc);
@@ -155,7 +173,6 @@ public abstract class BaseCriteriaRelyingPartyConfigurationResolver<ReturnType>
             final ProfileRequestContext prc = new ProfileRequestContext();
             final RelyingPartyContext rpc = prc.ensureSubcontext(RelyingPartyContext.class);
             rpc.setVerified(true);
-
             rpc.setRelyingPartyId(entityID);
 
             if (entityDescriptor != null || roleDescriptor != null) {
diff --git a/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java b/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
index f11b17c..3eace6e 100644
--- a/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
+++ b/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
@@ -282,7 +282,7 @@ public class DefaultRelyingPartyConfigurationResolver extends AbstractIdentifiab
         
         final ArrayList<RelyingPartyConfiguration> matches = new ArrayList<>();
 
-        final ProfileRequestContext context = getProfileRequestContext(criteria);
+        final ProfileRequestContext context = getProfileRequestContext(criteria, vpc != null && vpc.isVerified());
 
         for (final RelyingPartyConfiguration configuration : getRelyingPartyConfigurations()) {
             log.debug("Checking if relying party configuration {} is applicable", configuration.getId());
@@ -333,7 +333,7 @@ public class DefaultRelyingPartyConfigurationResolver extends AbstractIdentifiab
             return uvc;
         }
 
-        final ProfileRequestContext context = getProfileRequestContext(criteria);
+        final ProfileRequestContext context = getProfileRequestContext(criteria, vpc != null && vpc.isVerified());
 
         for (final RelyingPartyConfiguration configuration : getRelyingPartyConfigurations()) {
             log.debug("Checking if relying party configuration {} is applicable", configuration.getId());
@@ -421,10 +421,11 @@ public class DefaultRelyingPartyConfigurationResolver extends AbstractIdentifiab
      * Get the {@link ProfileRequestContext} included in the input criteria, if any.
      * 
      * @param criteria input criteria
+     * @param verified verified flag based on input criteria
      * 
      * @return embedded profile request context or null
      */
-    @Nullable private ProfileRequestContext getProfileRequestContext(@Nonnull final CriteriaSet criteria) {
+    @Nullable private ProfileRequestContext getProfileRequestContext(@Nonnull final CriteriaSet criteria, final boolean verified) {
         
         final ProfileRequestContextCriterion prcCriterion = criteria.get(ProfileRequestContextCriterion.class);
         if (prcCriterion != null) {
@@ -443,7 +444,7 @@ public class DefaultRelyingPartyConfigurationResolver extends AbstractIdentifiab
         if (entityID != null || entityDescriptor != null || roleDescriptor != null) {
             final ProfileRequestContext prc = new ProfileRequestContext();
             final RelyingPartyContext rpc = prc.ensureSubcontext(RelyingPartyContext.class);
-            rpc.setVerified(true);
+            rpc.setVerified(verified);
 
             rpc.setRelyingPartyId(entityID);
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.