[java-identity-provider] branch main updated: Switch to our StringDigester to handle long service IDs.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/6993f6007f3fa5dfb53a2486dbbbf8e834c0f9c7

The following commit(s) were added to refs/heads/main by this push:
     new 6993f6007 Switch to our StringDigester to handle long service IDs.
6993f6007 is described below

commit 6993f6007f3fa5dfb53a2486dbbbf8e834c0f9c7
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu Oct 22 10:20:06 2026 -0400

    Switch to our StringDigester to handle long service IDs.
---
 .../idp/session/impl/StorageBackedIdPSession.java      | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java
index b9d546148..388d4270e 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java
@@ -15,6 +15,7 @@
 package net.shibboleth.idp.session.impl;
 
 import java.io.IOException;
+import java.security.NoSuchAlgorithmException;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.Iterator;
@@ -35,10 +36,11 @@ import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.codec.StringDigester;
+import net.shibboleth.shared.codec.StringDigester.OutputFormat;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 
-import org.apache.commons.codec.digest.DigestUtils;
 import org.opensaml.storage.StorageRecord;
 import org.opensaml.storage.StorageSerializer;
 import org.opensaml.storage.VersionMismatchException;
@@ -729,12 +731,18 @@ public class StorageBackedIdPSession extends AbstractIdPSession {
      * @param serviceId the service identifier
      * = 
      * @return  an appropriately sized storage key
+     * 
+     * @throws IOException if unable to obtain digest algorithm to shrink service ID 
      */
-    @Nonnull @NotEmpty private String getSPSessionStorageKey(@Nonnull @NotEmpty final String serviceId) {
+    @Nonnull @NotEmpty private String getSPSessionStorageKey(@Nonnull @NotEmpty final String serviceId)
+            throws IOException {
         if (serviceId.length() > sessionManager.getStorageService().getCapabilities().getKeySize()) {
-            final String result = DigestUtils.sha256Hex(serviceId);
-            assert result != null;
-            return result;
+            try {
+                final String result = new StringDigester("SHA256", OutputFormat.HEX_LOWER).apply(serviceId);
+                return Constraint.isNotNull(result, "Digested service ID was null");
+            } catch (final NoSuchAlgorithmException e) {
+                throw new IOException("SHA256 algorithm missing from runtime?");
+            }
         }
         return serviceId;
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.