eclipse-ee4j / eclipse-ee4j/metro-wsit
support direct reference to saml token
- Dominant language
- Java
- Stars
- 6
- Forks
- 21
- Avg merge
- 10h 2m
- Merged PRs (30d)
- 1
Description
At the moment, KeySelectorImpl#resolveDirectReference does not support the case
where the ValueType attribute is null and the reference points to a SAML
assertion. No errors are logged or thrown, and direct references to SAML
assertions should be legal according to the WSS SAML Token Profile.
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[current]
Source: [https://github.com/javaee/metro-wsit/issues/1065](https://github.com/javaee/metro-wsit/issues/1065)
Author: glassfishrobot
Contributor guide
Research direction
Start by locating KeySelectorImpl#resolveDirectReference and trace how references with a null ValueType are handled. Compare that path with SAML assertion handling and inspect any nearby tests or protocol-related tests. Done means a direct reference to a SAML assertion with no ValueType is accepted and no longer silently fails.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100