[java-oidfed-common] branch main updated: Improve trust mark parsing and content verification
Codeberg
noreply at shibboleth.net
Fri Oct 30 09:09:40 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidfed-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/43c2d6a96c5ec045fd75cf8cf067e1103d3d825f
The following commit(s) were added to refs/heads/main by this push:
new 43c2d6a Improve trust mark parsing and content verification
43c2d6a is described below
commit 43c2d6a96c5ec045fd75cf8cf067e1103d3d825f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Oct 30 11:09:15 2026 +0200
Improve trust mark parsing and content verification
- Require sub and trust_mark_type in the TrustMarkImpl constructor
- Catch the ConstraintViolationException by the callers
- Exploit TrustMarkImpl in constant trust mark parsing (for entity configuration)
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 3 +-
.../oidfed/metadata/impl/TrustMarkImpl.java | 5 ++-
.../oidfed/profile/impl/CallResolveEntityApi.java | 3 +-
.../impl/DefaultConstantTrustMarkFunction.java | 42 +++++++++++++++++-----
...DefaultTrustChainTrustMarksParsingStrategy.java | 3 +-
5 files changed, 44 insertions(+), 12 deletions(-)
diff --git a/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 768bdd4..d25ff76 100644
--- a/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -1142,7 +1142,8 @@
p:trustMarkCache-ref="shibboleth.oidfed.TrustMarkMetadataCache"/>
<bean id="shibboleth.oidfed.ConstantTrustMark" abstract="true"
- class="net.shibboleth.oidfed.profile.impl.DefaultConstantTrustMarkFunction"/>
+ class="net.shibboleth.oidfed.profile.impl.DefaultConstantTrustMarkFunction"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
<bean id="shibboleth.oidfed.TrustedRemoteEntity" abstract="true"
class="net.shibboleth.oidfed.profile.TrustedRemoteEntity"/>
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/impl/TrustMarkImpl.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/impl/TrustMarkImpl.java
index e4b8bc6..b8fa2de 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/impl/TrustMarkImpl.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/impl/TrustMarkImpl.java
@@ -24,10 +24,11 @@ import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidfed.metadata.TrustMark;
import net.shibboleth.oidfed.metadata.payload.TrustMarkPayload;
import net.shibboleth.oidfed.metadata.payload.impl.TrustMarkPayloadImpl;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.ConstraintViolationException;
/**
- * A wrapper class extending {@link EntityStatementImpl} with parsed claims related to trust mark.
+ * A wrapper class extending {@link AbstractJWTWrapperImpl} with parsed claims related to trust mark.
*/
public class TrustMarkImpl extends AbstractJWTWrapperImpl<TrustMarkPayload> implements TrustMark {
@@ -42,6 +43,8 @@ public class TrustMarkImpl extends AbstractJWTWrapperImpl<TrustMarkPayload> impl
@Nonnull final TrustMarkPayload payload)
throws ConstraintViolationException {
super(signedJwt, payload);
+ Constraint.isNotEmpty(payload.getSubject(), "Subject cannot be empty in the payload");
+ Constraint.isNotEmpty(payload.getTrustMarkType(), "Trust mark type cannot be empty in the payload");
}
/**
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/CallResolveEntityApi.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/CallResolveEntityApi.java
index df2fa5e..1f45f8f 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/CallResolveEntityApi.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/CallResolveEntityApi.java
@@ -73,6 +73,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -545,7 +546,7 @@ public class CallResolveEntityApi extends AbstractProfileAction {
return TrustMarkImpl.parse(jwt, objectMapper);
} catch (final ParseException e) {
log.error("{} Could not parse the trust mark into a JWT", getLogPrefix(), e);
- } catch (final JsonProcessingException e) {
+ } catch (final ConstraintViolationException | JsonProcessingException e) {
log.error("{} Could not parse JWT payload into a trust mark", getLogPrefix(), e);
}
}
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultConstantTrustMarkFunction.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultConstantTrustMarkFunction.java
index 51f8ecf..cf033e8 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultConstantTrustMarkFunction.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultConstantTrustMarkFunction.java
@@ -24,13 +24,17 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jwt.SignedJWT;
+import net.shibboleth.oidfed.metadata.impl.TrustMarkImpl;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -42,9 +46,25 @@ public class DefaultConstantTrustMarkFunction extends AbstractIdentifiableInitia
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(DefaultConstantTrustMarkFunction.class);
+ /** JSON object mapper used for decoding Trust Mark. */
+ @NonnullAfterInit private ObjectMapper objectMapper;
+
/** Trust mark value. */
@NonnullAfterInit private String trustMark;
+ /** Parsed trust mark type value. */
+ @NonnullAfterInit private String trustMarkType;
+
+ /**
+ * Set the JSON {@link ObjectMapper} used for decoding Trust Mark.
+ *
+ * @param mapper object mapper
+ */
+ public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
+ checkSetterPreconditions();
+ objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
+ }
+
/**
* Set the trust mark.
*
@@ -58,22 +78,28 @@ public class DefaultConstantTrustMarkFunction extends AbstractIdentifiableInitia
/** {@inheritDoc} */
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
+ if (objectMapper == null) {
+ throw new ComponentInitializationException("Object mapper cannot be null");
+ }
if (trustMark == null) {
throw new ComponentInitializationException("Trust mark cannot be null");
}
+ final TrustMarkImpl parsedTrustMark;
+ try {
+ final SignedJWT jwt = SignedJWT.parse(trustMark);
+ assert jwt != null; assert objectMapper != null;
+ parsedTrustMark = TrustMarkImpl.parse(jwt, objectMapper);
+ } catch (final ParseException | ConstraintViolationException | JsonProcessingException e) {
+ log.error("Could not parse trust mark from the JWT", e);
+ throw new ComponentInitializationException("Could not parse trust mark from the JWT");
+ }
+ trustMarkType = parsedTrustMark.getParsedPayload().getTrustMarkType();
}
/** {@inheritDoc} */
@Override @Nullable
public Map<String, String> apply(@Nullable final ProfileRequestContext profileRequestContext) {
checkComponentActive();
- try {
- final SignedJWT jwt = SignedJWT.parse(trustMark);
- final String trustMarkType = jwt.getJWTClaimsSet().getStringClaim("trust_mark_type");
- return Map.of("trust_mark_type", trustMarkType, "trust_mark", trustMark);
- } catch (final ParseException e) {
- log.error("Could not parse JWT from the given trust mark {}", trustMark);
- }
- return null;
+ return Map.of("trust_mark_type", trustMarkType, "trust_mark", trustMark);
}
}
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java
index 15eda80..c62232f 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java
@@ -40,6 +40,7 @@ import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
@@ -171,7 +172,7 @@ public class DefaultTrustChainTrustMarksParsingStrategy extends AbstractIdentifi
log.warn("The id {} is not matching with the trust_mark_type-claim {}", id, trustMarkType);
} catch (final ParseException e) {
log.error("Could not parse id-claim from the trust mark", e);
- } catch (final JsonProcessingException e) {
+ } catch (final ConstraintViolationException | JsonProcessingException e) {
log.error("Could not parse trust mark from the JWT", e);
}
return null;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list