eclipse-ee4j / eclipse-ee4j/metro-wsit
In DefaultSAMLTokenProvider saml2:SubjectConfirmationData populated when saml2:SubjectConfirmation Method specified as "urn:oasis:names:tc:SAML:2.0:cm:sender-vouches"
- Dominant language
- Java
- Stars
- 6
- Forks
- 21
- Avg merge
- 10h 2m
- Merged PRs (30d)
- 1
Description
Line 131 in com.sun.xml.ws.security.trust.impl.DefaultSAMLTokenProvider.java creates KeyInfo regardless of the
confirMethod (SubjectConfirmationMethod specified in the IssuedTokenContext (ctx).
final KeyInfo keyInfo = createKeyInfo(ctx);
It's propagated to createSAML20Assertion where (it's actually handled correctly) KeyInfoConfirmationData is created for SV type, which is incorrect.
if (keyInfo != null){
keyInfoConfData = samlFac.createKeyInfoConfirmationData(keyInfo.getElement());
}
...
final SubjectConfirmation subjectConfirm = samlFac.createSubjectConfirmation(
null, keyInfoConfData, confirMethod);
SV subject confirmation should not have SubjectConfirmationData/KeyInfo in the SAML assertion.
#### Environment
any
#### Affected Versions
[2.1]
Source: [https://github.com/javaee/metro-wsit/issues/1575](https://github.com/javaee/metro-wsit/issues/1575)
Author: glassfishrobot
Contributor guide
Assessment
This issue has not been assessed yet.