[java-identity-provider] branch main updated: Revert "IDP-2480 - Add logging to isAcceptable machinery in authn layer"
Codeberg
noreply at shibboleth.net
Wed Sep 23 18:06:27 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/f902d2aaaba9552f18b688277f1389d1736f04da
The following commit(s) were added to refs/heads/main by this push:
new f902d2aaa Revert "IDP-2480 - Add logging to isAcceptable machinery in authn layer"
f902d2aaa is described below
commit f902d2aaaba9552f18b688277f1389d1736f04da
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Sep 23 14:06:10 2026 -0400
Revert "IDP-2480 - Add logging to isAcceptable machinery in authn layer"
This reverts commit f692672008caf8de01b31284ded4c0e0f08e04a8.
---
.../idp/authn/AbstractCredentialValidator.java | 50 +++++++++++-----------
.../idp/authn/AbstractValidationAction.java | 40 +++++++++--------
.../authn/context/RequestedPrincipalContext.java | 8 +++-
.../PrincipalEvalPredicateFactoryRegistry.java | 12 ++----
.../idp/authn/impl/FinalizeAuthentication.java | 3 +-
5 files changed, 59 insertions(+), 54 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
index e7aa785da..c0a1bc544 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
@@ -199,33 +199,35 @@ public abstract class AbstractCredentialValidator extends AbstractIdentifiedInit
if (subject != null && requestedPrincipalCtx != null) {
final String operator = requestedPrincipalCtx.getOperator();
- log.debug("{} Request contains principal requirements, checking validator '{}' for compatibility",
- getLogPrefix(), configName);
- for (final Principal p : requestedPrincipalCtx.getRequestedPrincipals()) {
- final PrincipalEvalPredicateFactory factory =
- requestedPrincipalCtx.getPrincipalEvalPredicateFactoryRegistry().lookup(
- p.getClass(), operator);
- if (factory != null) {
- final PrincipalEvalPredicate predicate = factory.getPredicate(p);
- final PrincipalSupportingComponent wrapper = new PrincipalSupportingComponent() {
- @Nonnull
- public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull final Class<T> c) {
- Set<T> principals = subject.getPrincipals(c);
- assert principals!=null;
- return principals;
+ if (operator != null) {
+ log.debug("{} Request contains principal requirements, checking validator '{}' for compatibility",
+ getLogPrefix(), configName);
+ for (final Principal p : requestedPrincipalCtx.getRequestedPrincipals()) {
+ final PrincipalEvalPredicateFactory factory =
+ requestedPrincipalCtx.getPrincipalEvalPredicateFactoryRegistry().lookup(
+ p.getClass(), operator);
+ if (factory != null) {
+ final PrincipalEvalPredicate predicate = factory.getPredicate(p);
+ final PrincipalSupportingComponent wrapper = new PrincipalSupportingComponent() {
+ @Nonnull
+ public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull final Class<T> c) {
+ Set<T> principals = subject.getPrincipals(c);
+ assert principals!=null;
+ return principals;
+ }
+ };
+ if (predicate.test(wrapper)) {
+ log.debug("{} Validator '{}' compatible with principal type '{}' and operator '{}'",
+ getLogPrefix(), configName, p.getClass(), requestedPrincipalCtx.getOperator());
+ requestedPrincipalCtx.setMatchingPrincipal(predicate.getMatchingPrincipal());
+ return true;
}
- };
- if (predicate.test(wrapper)) {
- log.debug("{} Validator '{}' compatible with principal type '{}' and operator '{}'",
+ log.debug("{} Validator '{}' not compatible with principal type '{}' and operator '{}'",
getLogPrefix(), configName, p.getClass(), requestedPrincipalCtx.getOperator());
- requestedPrincipalCtx.setMatchingPrincipal(predicate.getMatchingPrincipal());
- return true;
+ } else {
+ log.debug("{} No comparison logic registered for principal type '{}' and operator '{}'",
+ getLogPrefix(), p.getClass(), requestedPrincipalCtx.getOperator());
}
- log.debug("{} Validator '{}' not compatible with principal type '{}' and operator '{}'",
- getLogPrefix(), configName, p.getClass(), requestedPrincipalCtx.getOperator());
- } else {
- log.debug("{} No comparison logic registered for principal type '{}' and operator '{}'",
- getLogPrefix(), p.getClass(), requestedPrincipalCtx.getOperator());
}
}
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
index 2a7dc3d52..b7c43b13c 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
@@ -337,29 +337,31 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
final RequestedPrincipalContext rpCtx = authenticationContext.getSubcontext(RequestedPrincipalContext.class);
if (rpCtx != null && !getSubject().getPrincipals().isEmpty()) {
final String operator = rpCtx.getOperator();
- log.debug("{} Request contains principal requirements, evaluating for compatibility", getLogPrefix());
- for (final Principal p : rpCtx.getRequestedPrincipals()) {
- final PrincipalEvalPredicateFactory factory =
- rpCtx.getPrincipalEvalPredicateFactoryRegistry().lookup(p.getClass(), operator);
- if (factory != null) {
- final PrincipalEvalPredicate predicate = factory.getPredicate(p);
- if (predicate.test(this)) {
- log.debug("{} Compatible with principal type '{}' and operator '{}'", getLogPrefix(),
+ if (operator != null) {
+ log.debug("{} Request contains principal requirements, evaluating for compatibility", getLogPrefix());
+ for (final Principal p : rpCtx.getRequestedPrincipals()) {
+ final PrincipalEvalPredicateFactory factory =
+ rpCtx.getPrincipalEvalPredicateFactoryRegistry().lookup(p.getClass(), operator);
+ if (factory != null) {
+ final PrincipalEvalPredicate predicate = factory.getPredicate(p);
+ if (predicate.test(this)) {
+ log.debug("{} Compatible with principal type '{}' and operator '{}'", getLogPrefix(),
+ p.getClass(), operator);
+ rpCtx.setMatchingPrincipal(predicate.getMatchingPrincipal());
+ return true;
+ }
+ log.debug("{} Not compatible with principal type '{}' and operator '{}'", getLogPrefix(),
p.getClass(), operator);
- rpCtx.setMatchingPrincipal(predicate.getMatchingPrincipal());
- return true;
+ } else {
+ log.debug("{} No comparison logic registered for principal type '{}' and operator '{}'",
+ getLogPrefix(), p.getClass(), operator);
}
- log.debug("{} Not compatible with principal type '{}' and operator '{}'", getLogPrefix(),
- p.getClass(), operator);
- } else {
- log.debug("{} No comparison logic registered for principal type '{}' and operator '{}'",
- getLogPrefix(), p.getClass(), operator);
}
+
+ log.info("{} Skipping validator, not compatible with request's principal requirements", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.REQUEST_UNSUPPORTED);
+ return false;
}
-
- log.info("{} Skipping validator, not compatible with request's principal requirements", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.REQUEST_UNSUPPORTED);
- return false;
}
final Function<ProfileRequestContext,String> strategy = authenticationContext.getFixedEventLookupStrategy();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
index 2938a8230..376a1d74c 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
@@ -209,8 +209,12 @@ public final class RequestedPrincipalContext extends BaseContext {
*/
@Nullable public PrincipalEvalPredicate getPredicate(@Nonnull final Principal principal) {
- final PrincipalEvalPredicateFactory factory = evalRegistry.lookup(principal.getClass(), getOperator());
- return factory != null ? factory.getPredicate(principal) : null;
+ final String op = getOperator();
+ if (op != null) {
+ final PrincipalEvalPredicateFactory factory = evalRegistry.lookup(principal.getClass(), op);
+ return factory != null ? factory.getPredicate(principal) : null;
+ }
+ return null;
}
/**
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
index 62dd38c7a..d65bbe943 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
@@ -101,14 +101,10 @@ public final class PrincipalEvalPredicateFactoryRegistry {
* @return a corresponding predicate factory, or null
*/
@Nullable public PrincipalEvalPredicateFactory lookup(@Nonnull final Class<? extends Principal> principalType,
- @Nullable final String operator) {
+ @Nonnull @NotEmpty final String operator) {
Constraint.isNotNull(principalType, "Principal subtype cannot be null");
-
- final String trimmed = StringSupport.trimOrNull(operator);
- if (trimmed == null) {
- log.warn("Operator was null/empty, no predicate returned");
- return null;
- }
+ final String trimmed =
+ Constraint.isNotNull(StringSupport.trimOrNull(operator), "Operator cannot be null or empty");
final Pair<?,?> key = new Pair<>(principalType, trimmed);
final PrincipalEvalPredicateFactory factory = registry.get(key);
@@ -117,7 +113,7 @@ public final class PrincipalEvalPredicateFactoryRegistry {
factory.getClass().getName(), principalType, trimmed);
return factory;
}
- log.info("Registry failed to locate predicate factory for principal type '{}' and operator '{}'",
+ log.debug("Registry failed to locate predicate factory for principal type '{}' and operator '{}'",
principalType, trimmed);
return null;
}
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
index 6dc7a5160..cb80489ba 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
@@ -146,7 +146,7 @@ public class FinalizeAuthentication extends AbstractAuthenticationAction {
// and the actual result produced may be a subset (and therefore could be an inadequate subset).
final RequestedPrincipalContext requestedPrincipalCtx =
authenticationContext.getSubcontext(RequestedPrincipalContext.class);
- if (requestedPrincipalCtx != null) {
+ if (requestedPrincipalCtx != null && requestedPrincipalCtx.getOperator() != null) {
// If a matching principal is set, re-verify it. Normally this will work.
final Principal match = requestedPrincipalCtx.getMatchingPrincipal();
@@ -237,6 +237,7 @@ public class FinalizeAuthentication extends AbstractAuthenticationAction {
assert ar != null;
for (final Principal p : requestedPrincipalCtx.getRequestedPrincipals()) {
final String op = requestedPrincipalCtx.getOperator();
+ assert op != null;
log.debug("{} Checking result for compatibility with operator '{}' and principal '{}'",
getLogPrefix(), op, p.getName());
final PrincipalEvalPredicateFactory factory =
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list