IdP 5.1.2 and missing argument on resovlertest from command line causing very bad behavior

[Michael Grady]

So running IdP 5.1.2 and:

OpenJDK Runtime Environment Corretto-17.0.11.9.1 (build 17.0.11+9-LTS)
OpenJDK 64-Bit Server VM Corretto-17.0.11.9.1 (build 17.0.11+9-LTS, mixed mode, sharing)

Using CATALINA_OPTS:    -Xms2048m -XX:+UseG1GC -Xloggc:/opt/tomcat/logs/garbage-collection.log
Server version: Apache Tomcat/10.1.20
Server built:   Mar 19 2024 12:49:58 UTC
Server number:  10.1.20.0
OS Name:        Linux
OS Version:     4.14.345-262.561.amzn2.x86_64
Architecture:   amd64
JVM Version:    17.0.11+9-LTS
JVM Vendor:     Amazon.com Inc.

Running in a Docker container, I get into an instance and enter the following command, missing the requester arg:

 curl -s -k 'http://localhost:8080/idp/profile/admin/resolvertest?principal=username'

That seems to put the IdP into a "loop" of running resolvertest commands, resulting in thousands of entires in the audit log similar to this:

 2024-07-29T19:04:13+00:00 5fe30276c76d org-test - 2024-07-29T19:04:13.588816701Z|RuntimeException|http://localhost:8080/idp/profile/admin/resolvertest|/idp/profile/admin/resolvertest|||127.0.0.1|curl/7.68.0|http://shibboleth.net/ns/profiles/resolvertest|||||||||||||||||||||||||| <http://localhost:8080/idp/profile/admin/resolvertest%7C/idp/profile/admin/resolvertest%7C%7C%7C127.0.0.1%7Ccurl/7.68.0%7Chttp://shibboleth.net/ns/profiles/resolvertest%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C>

And it causes a StackOverflow error like this:

2024-07-29T18:59:47+00:00 5fe30276c76d utpb-test - 127.0.0.1 - ERROR [jakarta.servlet.ServletException:144] - jakarta.servlet.ServletException: Handler dispatch failed: java.lang.StackOverflowError#012#011at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1104)#012Caused by: java.lang.StackOverflowError: null#012#011at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:651)#012

Tried it on several IdPs (all with same environment as above, but otherwise distinct config), and the same thing occurs.

(Of course, one answer is "don't enter an incorrect resolvertest command  :-)

--
Michael A. Grady
IAM Architect, Unicon, Inc.