Skip to content

Commit f8d417d

Browse files
jzheauxjzheaux
committed
Preserve Encrypted Elements
Closes gh-16367
1 parent 79bacf8 commit f8d417d

File tree

18 files changed

+134
-178
lines changed

18 files changed

+134
-178
lines changed

Diff for: ‎saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/internal/OpenSaml4Template.java

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -482,7 +482,6 @@ public void decrypt(XMLObject object) {
482482

483483
private void decryptResponse(Response response) {
484484
Collection<Assertion> decrypteds = new ArrayList<>();
485-
Collection<EncryptedAssertion> encrypteds = new ArrayList<>();
486485

487486
int count = 0;
488487
int size = response.getEncryptedAssertions().size();
@@ -492,7 +491,6 @@ private void decryptResponse(Response response) {
492491
try {
493492
Assertion decrypted = this.decrypter.decrypt(encrypted);
494493
if (decrypted != null) {
495-
encrypteds.add(encrypted);
496494
decrypteds.add(decrypted);
497495
}
498496
count++;
@@ -502,7 +500,6 @@ private void decryptResponse(Response response) {
502500
}
503501
}
504502

505-
response.getEncryptedAssertions().removeAll(encrypteds);
506503
response.getAssertions().addAll(decrypteds);
507504

508505
// Re-marshall the response so that any ID attributes within the decrypted
@@ -534,7 +531,6 @@ private void decryptAssertion(Assertion assertion) {
534531
NameID decrypted = (NameID) this.decrypter.decrypt(d.getEncryptedID());
535532
if (decrypted != null) {
536533
d.setNameID(decrypted);
537-
d.setEncryptedID(null);
538534
}
539535
}
540536
catch (DecryptionException ex) {
@@ -548,20 +544,17 @@ private void decryptAssertion(Assertion assertion) {
548544

549545
private void decryptAttributes(AttributeStatement statement) {
550546
Collection<Attribute> decrypteds = new ArrayList<>();
551-
Collection<EncryptedAttribute> encrypteds = new ArrayList<>();
552547
for (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {
553548
try {
554549
Attribute decrypted = this.decrypter.decrypt(encrypted);
555550
if (decrypted != null) {
556-
encrypteds.add(encrypted);
557551
decrypteds.add(decrypted);
558552
}
559553
}
560554
catch (Exception ex) {
561555
throw new Saml2Exception(ex);
562556
}
563557
}
564-
statement.getEncryptedAttributes().removeAll(encrypteds);
565558
statement.getAttributes().addAll(decrypteds);
566559
}
567560

@@ -572,7 +565,6 @@ private void decryptSubject(Subject subject) {
572565
NameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());
573566
if (decrypted != null) {
574567
subject.setNameID(decrypted);
575-
subject.setEncryptedID(null);
576568
}
577569
}
578570
catch (final DecryptionException ex) {
@@ -586,7 +578,6 @@ private void decryptSubject(Subject subject) {
586578
NameID decrypted = (NameID) this.decrypter.decrypt(sc.getEncryptedID());
587579
if (decrypted != null) {
588580
sc.setNameID(decrypted);
589-
sc.setEncryptedID(null);
590581
}
591582
}
592583
catch (final DecryptionException ex) {
@@ -603,7 +594,6 @@ private void decryptLogoutRequest(LogoutRequest request) {
603594
NameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());
604595
if (decrypted != null) {
605596
request.setNameID(decrypted);
606-
request.setEncryptedID(null);
607597
}
608598
}
609599
catch (DecryptionException ex) {

Diff for: ‎saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4Template.java

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -482,7 +482,6 @@ public void decrypt(XMLObject object) {
482482

483483
private void decryptResponse(Response response) {
484484
Collection<Assertion> decrypteds = new ArrayList<>();
485-
Collection<EncryptedAssertion> encrypteds = new ArrayList<>();
486485

487486
int count = 0;
488487
int size = response.getEncryptedAssertions().size();
@@ -492,7 +491,6 @@ private void decryptResponse(Response response) {
492491
try {
493492
Assertion decrypted = this.decrypter.decrypt(encrypted);
494493
if (decrypted != null) {
495-
encrypteds.add(encrypted);
496494
decrypteds.add(decrypted);
497495
}
498496
count++;
@@ -502,7 +500,6 @@ private void decryptResponse(Response response) {
502500
}
503501
}
504502

505-
response.getEncryptedAssertions().removeAll(encrypteds);
506503
response.getAssertions().addAll(decrypteds);
507504

508505
// Re-marshall the response so that any ID attributes within the decrypted
@@ -534,7 +531,6 @@ private void decryptAssertion(Assertion assertion) {
534531
NameID decrypted = (NameID) this.decrypter.decrypt(d.getEncryptedID());
535532
if (decrypted != null) {
536533
d.setNameID(decrypted);
537-
d.setEncryptedID(null);
538534
}
539535
}
540536
catch (DecryptionException ex) {
@@ -548,20 +544,17 @@ private void decryptAssertion(Assertion assertion) {
548544

549545
private void decryptAttributes(AttributeStatement statement) {
550546
Collection<Attribute> decrypteds = new ArrayList<>();
551-
Collection<EncryptedAttribute> encrypteds = new ArrayList<>();
552547
for (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {
553548
try {
554549
Attribute decrypted = this.decrypter.decrypt(encrypted);
555550
if (decrypted != null) {
556-
encrypteds.add(encrypted);
557551
decrypteds.add(decrypted);
558552
}
559553
}
560554
catch (Exception ex) {
561555
throw new Saml2Exception(ex);
562556
}
563557
}
564-
statement.getEncryptedAttributes().removeAll(encrypteds);
565558
statement.getAttributes().addAll(decrypteds);
566559
}
567560

@@ -572,7 +565,6 @@ private void decryptSubject(Subject subject) {
572565
NameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());
573566
if (decrypted != null) {
574567
subject.setNameID(decrypted);
575-
subject.setEncryptedID(null);
576568
}
577569
}
578570
catch (final DecryptionException ex) {
@@ -586,7 +578,6 @@ private void decryptSubject(Subject subject) {
586578
NameID decrypted = (NameID) this.decrypter.decrypt(sc.getEncryptedID());
587579
if (decrypted != null) {
588580
sc.setNameID(decrypted);
589-
sc.setEncryptedID(null);
590581
}
591582
}
592583
catch (final DecryptionException ex) {
@@ -603,7 +594,6 @@ private void decryptLogoutRequest(LogoutRequest request) {
603594
NameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());
604595
if (decrypted != null) {
605596
request.setNameID(decrypted);
606-
request.setEncryptedID(null);
607597
}
608598
}
609599
catch (DecryptionException ex) {

Diff for: ‎saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/authentication/logout/OpenSaml4Template.java

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -482,7 +482,6 @@ public void decrypt(XMLObject object) {
482482

483483
private void decryptResponse(Response response) {
484484
Collection<Assertion> decrypteds = new ArrayList<>();
485-
Collection<EncryptedAssertion> encrypteds = new ArrayList<>();
486485

487486
int count = 0;
488487
int size = response.getEncryptedAssertions().size();
@@ -492,7 +491,6 @@ private void decryptResponse(Response response) {
492491
try {
493492
Assertion decrypted = this.decrypter.decrypt(encrypted);
494493
if (decrypted != null) {
495-
encrypteds.add(encrypted);
496494
decrypteds.add(decrypted);
497495
}
498496
count++;
@@ -502,7 +500,6 @@ private void decryptResponse(Response response) {
502500
}
503501
}
504502

505-
response.getEncryptedAssertions().removeAll(encrypteds);
506503
response.getAssertions().addAll(decrypteds);
507504

508505
// Re-marshall the response so that any ID attributes within the decrypted
@@ -534,7 +531,6 @@ private void decryptAssertion(Assertion assertion) {
534531
NameID decrypted = (NameID) this.decrypter.decrypt(d.getEncryptedID());
535532
if (decrypted != null) {
536533
d.setNameID(decrypted);
537-
d.setEncryptedID(null);
538534
}
539535
}
540536
catch (DecryptionException ex) {
@@ -548,20 +544,17 @@ private void decryptAssertion(Assertion assertion) {
548544

549545
private void decryptAttributes(AttributeStatement statement) {
550546
Collection<Attribute> decrypteds = new ArrayList<>();
551-
Collection<EncryptedAttribute> encrypteds = new ArrayList<>();
552547
for (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {
553548
try {
554549
Attribute decrypted = this.decrypter.decrypt(encrypted);
555550
if (decrypted != null) {
556-
encrypteds.add(encrypted);
557551
decrypteds.add(decrypted);
558552
}
559553
}
560554
catch (Exception ex) {
561555
throw new Saml2Exception(ex);
562556
}
563557
}
564-
statement.getEncryptedAttributes().removeAll(encrypteds);
565558
statement.getAttributes().addAll(decrypteds);
566559
}
567560

@@ -572,7 +565,6 @@ private void decryptSubject(Subject subject) {
572565
NameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());
573566
if (decrypted != null) {
574567
subject.setNameID(decrypted);
575-
subject.setEncryptedID(null);
576568
}
577569
}
578570
catch (final DecryptionException ex) {
@@ -586,7 +578,6 @@ private void decryptSubject(Subject subject) {
586578
NameID decrypted = (NameID) this.decrypter.decrypt(sc.getEncryptedID());
587579
if (decrypted != null) {
588580
sc.setNameID(decrypted);
589-
sc.setEncryptedID(null);
590581
}
591582
}
592583
catch (final DecryptionException ex) {
@@ -603,7 +594,6 @@ private void decryptLogoutRequest(LogoutRequest request) {
603594
NameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());
604595
if (decrypted != null) {
605596
request.setNameID(decrypted);
606-
request.setEncryptedID(null);
607597
}
608598
}
609599
catch (DecryptionException ex) {

Diff for: ‎saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml4Template.java

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -482,7 +482,6 @@ public void decrypt(XMLObject object) {
482482

483483
private void decryptResponse(Response response) {
484484
Collection<Assertion> decrypteds = new ArrayList<>();
485-
Collection<EncryptedAssertion> encrypteds = new ArrayList<>();
486485

487486
int count = 0;
488487
int size = response.getEncryptedAssertions().size();
@@ -492,7 +491,6 @@ private void decryptResponse(Response response) {
492491
try {
493492
Assertion decrypted = this.decrypter.decrypt(encrypted);
494493
if (decrypted != null) {
495-
encrypteds.add(encrypted);
496494
decrypteds.add(decrypted);
497495
}
498496
count++;
@@ -502,7 +500,6 @@ private void decryptResponse(Response response) {
502500
}
503501
}
504502

505-
response.getEncryptedAssertions().removeAll(encrypteds);
506503
response.getAssertions().addAll(decrypteds);
507504

508505
// Re-marshall the response so that any ID attributes within the decrypted
@@ -534,7 +531,6 @@ private void decryptAssertion(Assertion assertion) {
534531
NameID decrypted = (NameID) this.decrypter.decrypt(d.getEncryptedID());
535532
if (decrypted != null) {
536533
d.setNameID(decrypted);
537-
d.setEncryptedID(null);
538534
}
539535
}
540536
catch (DecryptionException ex) {
@@ -548,20 +544,17 @@ private void decryptAssertion(Assertion assertion) {
548544

549545
private void decryptAttributes(AttributeStatement statement) {
550546
Collection<Attribute> decrypteds = new ArrayList<>();
551-
Collection<EncryptedAttribute> encrypteds = new ArrayList<>();
552547
for (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {
553548
try {
554549
Attribute decrypted = this.decrypter.decrypt(encrypted);
555550
if (decrypted != null) {
556-
encrypteds.add(encrypted);
557551
decrypteds.add(decrypted);
558552
}
559553
}
560554
catch (Exception ex) {
561555
throw new Saml2Exception(ex);
562556
}
563557
}
564-
statement.getEncryptedAttributes().removeAll(encrypteds);
565558
statement.getAttributes().addAll(decrypteds);
566559
}
567560

@@ -572,7 +565,6 @@ private void decryptSubject(Subject subject) {
572565
NameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());
573566
if (decrypted != null) {
574567
subject.setNameID(decrypted);
575-
subject.setEncryptedID(null);
576568
}
577569
}
578570
catch (final DecryptionException ex) {
@@ -586,7 +578,6 @@ private void decryptSubject(Subject subject) {
586578
NameID decrypted = (NameID) this.decrypter.decrypt(sc.getEncryptedID());
587579
if (decrypted != null) {
588580
sc.setNameID(decrypted);
589-
sc.setEncryptedID(null);
590581
}
591582
}
592583
catch (final DecryptionException ex) {
@@ -603,7 +594,6 @@ private void decryptLogoutRequest(LogoutRequest request) {
603594
NameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());
604595
if (decrypted != null) {
605596
request.setNameID(decrypted);
606-
request.setEncryptedID(null);
607597
}
608598
}
609599
catch (DecryptionException ex) {

0 commit comments

Comments
 (0)