Uploaded image for project: 'PicketLink'
  1. PicketLink
  2. PLINK-760

SAML2AuthenticationHandler#handleRequestType should check request method against HttpContext Request instance instead of AuthnRequestType

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • PLINK_2.7.1.Final
    • SAML
    • None

      The fix of PLINK-700 introduces a regression in HTTP Redirect workflow use-cases (between SP and IdP) by the following change:

      SAML2AuthenticationHandler.java
      -                boolean isPost = httpContext.getRequest().getMethod().equalsIgnoreCase("POST");
      +               boolean isPost = art.getProtocolBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
      

      Even if httpContext.getRequest() has set GET http method, the handleRequestType method now assumes it being POST in case of urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST in AuthnRequestType.

              psilva@redhat.com Pedro Igor Craveiro
              istudens@redhat.com Ivo Studensky
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: