[java-plugin-shibd] branch main updated: Create RP context from scratch to prevent cross-flow contamination.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/4aae3d495218dc952ab1dd2a2f9a914f1fb924a6

The following commit(s) were added to refs/heads/main by this push:
     new 4aae3d4  Create RP context from scratch to prevent cross-flow contamination.
4aae3d4 is described below

commit 4aae3d495218dc952ab1dd2a2f9a914f1fb924a6
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Oct 14 13:25:11 2026 -0400

    Create RP context from scratch to prevent cross-flow contamination.
---
 .../SessionInitiatorFlowDescriptorManager.java     |  2 +-
 .../impl/ValidateSessionInitiatorRequest.java      | 40 +++-------------------
 2 files changed, 6 insertions(+), 36 deletions(-)

diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SessionInitiatorFlowDescriptorManager.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SessionInitiatorFlowDescriptorManager.java
index 68e4c88..71f9f86 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SessionInitiatorFlowDescriptorManager.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SessionInitiatorFlowDescriptorManager.java
@@ -68,7 +68,7 @@ public class SessionInitiatorFlowDescriptorManager extends IdentifiedComponentMa
     }
 
     /**
-     * Checks if a flow ID corresponds to a valid flow that in turn ius active for the request.
+     * Checks if a flow ID corresponds to a valid flow that's active for the request.
      * 
      * @param id flow ID
      * @param profileRequestContext current profile request context
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
index ec75f4a..a513582 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
@@ -14,12 +14,9 @@
 
 package net.shibboleth.sp.profile.impl;
 
-import java.util.function.Function;
-
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -32,7 +29,6 @@ import net.shibboleth.sp.profile.AbstractApplicationAction;
 import net.shibboleth.sp.profile.InitiatorConstants;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.shared.logic.Constraint;
 
 /**
  * Initiating action of a typical Session Initiator flow, this validates the input message for
@@ -58,9 +54,6 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
 
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateSessionInitiatorRequest.class);
-
-    /** Creation strategy for {@link RelyingPartyContext}. */
-    @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextCreationStrategy;
     
     /** Initiator flow indicator for logging. */
     @Nullable private String flowId;
@@ -73,11 +66,6 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
     
     /** The relying party name to base the inbound context on. */
     @Nullable private String relyingPartyId;
-
-    /** Constructor. */
-    public ValidateSessionInitiatorRequest() {
-        relyingPartyContextCreationStrategy = new ChildContextLookup<>(RelyingPartyContext.class, true);
-    }
     
     /**
      * Set initiator flow ID for logging. 
@@ -89,21 +77,7 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
         
         flowId = StringSupport.trimOrNull(id);
     }
-    
-    /**
-     * Set an optional lookup strategy to identify the relying party name, as a substitute for the session/logout
-     * assumptions made by the action otherwise.
-     * 
-     * @param strategy lookup strategy
-     */
-    public void setRelyingPartyContextCreationStrategy(
-            @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
-        checkSetterPreconditions();
         
-        relyingPartyContextCreationStrategy =
-                Constraint.isNotNull(strategy, "RelyingPartyContext creation strategy cannot be null");
-    }
-    
     /**
      * Sets whether to require that a relying party ID be available.
      * 
@@ -189,15 +163,11 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
     
     /** {@inheritDoc} */
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
-        final RelyingPartyContext rpContext = relyingPartyContextCreationStrategy.apply(profileRequestContext);
-        if (rpContext == null) {
-            ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
-            log.error("{} Unable to create RelyingPartyContext", getLogPrefix());
-            return;
-        }
-
-        rpContext.setRelyingPartyId(relyingPartyId);
+        
+        final RelyingPartyContext rpContext = new RelyingPartyContext();
+        rpContext.setRelyingPartyId(relyingPartyId);        
+        profileRequestContext.addSubcontext(rpContext, true);
+        
         log.debug("{} Initialized RelyingPartyContext for {}", getLogPrefix(),
                 relyingPartyId != null ? relyingPartyId : "unidentified authority");
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.