eclipse-ee4j / eclipse-ee4j/metro-wsit

In DefaultSAMLTokenProvider saml2:SubjectConfirmationData populated when saml2:SubjectConfirmation Method specified as "urn:oasis:names:tc:SAML:2.0:cm:sender-vouches"

Open
#352 0 comments 0 reactions 0 assignees View on GitHub
Component: trust ERR: Assignee metro2_2-waived Priority: Minor Type: Bug
Dominant language
Java
Stars
6
Forks
21
Avg merge
10h 2m
Merged PRs (30d)
1

Description

Line 131 in com.sun.xml.ws.security.trust.impl.DefaultSAMLTokenProvider.java creates KeyInfo regardless of the
confirMethod (SubjectConfirmationMethod specified in the IssuedTokenContext (ctx).
final KeyInfo keyInfo = createKeyInfo(ctx);

It's propagated to createSAML20Assertion where (it's actually handled correctly) KeyInfoConfirmationData is created for SV type, which is incorrect.
if (keyInfo != null){
keyInfoConfData = samlFac.createKeyInfoConfirmationData(keyInfo.getElement());
}
...
final SubjectConfirmation subjectConfirm = samlFac.createSubjectConfirmation(
null, keyInfoConfData, confirMethod);

SV subject confirmation should not have SubjectConfirmationData/KeyInfo in the SAML assertion.
#### Environment
any
#### Affected Versions
[2.1]

Source: [https://github.com/javaee/metro-wsit/issues/1575](https://github.com/javaee/metro-wsit/issues/1575)
Author: glassfishrobot

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.