From 5b2e5d5efc1f8f0b6416c6e5e7dd872040a5811d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EB=B0=95=ED=95=98=EB=AF=BC?= Date: Sat, 29 Aug 2026 21:00:40 +0900 Subject: [PATCH] Read relayState from authenticationRequest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 박하민 --- ...eSaml2AuthenticationRequestRepository.java | 2 +- ...2AuthenticationRequestRepositoryTests.java | 25 +++++++++++++------ 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepository.java b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepository.java index c53f7004d4d..c16f8f4c721 100644 --- a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepository.java +++ b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepository.java @@ -54,7 +54,7 @@ public final class CacheSaml2AuthenticationRequestRepository public void saveAuthenticationRequest(AbstractSaml2AuthenticationRequest authenticationRequest, HttpServletRequest request, HttpServletResponse response) { Assert.notNull(authenticationRequest, "authenticationRequest must not be null"); - String relayState = request.getParameter(Saml2ParameterNames.RELAY_STATE); + String relayState = authenticationRequest.getRelayState(); Assert.notNull(relayState, "relayState must not be null"); this.cache.put(relayState, authenticationRequest); } diff --git a/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepositoryTests.java b/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepositoryTests.java index 10a77bdef6d..b4ee3b450bc 100644 --- a/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepositoryTests.java +++ b/saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/CacheSaml2AuthenticationRequestRepositoryTests.java @@ -42,15 +42,25 @@ class CacheSaml2AuthenticationRequestRepositoryTests { @Test void loadAuthenticationRequestWhenCachedThenReturns() { - MockHttpServletRequest request = new MockHttpServletRequest(); - request.setParameter(Saml2ParameterNames.RELAY_STATE, "test"); Saml2PostAuthenticationRequest authenticationRequest = TestSaml2PostAuthenticationRequests.create(); + String relayState = authenticationRequest.getRelayState(); + MockHttpServletRequest request = new MockHttpServletRequest(); + request.setParameter(Saml2ParameterNames.RELAY_STATE, relayState); this.repository.saveAuthenticationRequest(authenticationRequest, request, null); assertThat(this.repository.loadAuthenticationRequest(request)).isEqualTo(authenticationRequest); this.repository.removeAuthenticationRequest(request, null); assertThat(this.repository.loadAuthenticationRequest(request)).isNull(); } + @Test + void saveAuthenticationRequestWhenRelayStateOnlyInAuthenticationRequestThenSaves() { + Saml2PostAuthenticationRequest authenticationRequest = TestSaml2PostAuthenticationRequests.create(); + MockHttpServletRequest request = new MockHttpServletRequest(); + this.repository.saveAuthenticationRequest(authenticationRequest, request, null); + request.setParameter(Saml2ParameterNames.RELAY_STATE, authenticationRequest.getRelayState()); + assertThat(this.repository.loadAuthenticationRequest(request)).isEqualTo(authenticationRequest); + } + @Test void loadAuthenticationRequestWhenNoRelayStateThenException() { MockHttpServletRequest request = new MockHttpServletRequest(); @@ -77,15 +87,16 @@ void repositoryWhenCustomCacheThenUses() { CacheSaml2AuthenticationRequestRepository repository = new CacheSaml2AuthenticationRequestRepository(); Cache cache = spy(new ConcurrentMapCache("requests")); repository.setCache(cache); - MockHttpServletRequest request = new MockHttpServletRequest(); - request.setParameter(Saml2ParameterNames.RELAY_STATE, "test"); Saml2PostAuthenticationRequest authenticationRequest = TestSaml2PostAuthenticationRequests.create(); + String relayState = authenticationRequest.getRelayState(); + MockHttpServletRequest request = new MockHttpServletRequest(); + request.setParameter(Saml2ParameterNames.RELAY_STATE, relayState); repository.saveAuthenticationRequest(authenticationRequest, request, null); - verify(cache).put(eq("test"), any()); + verify(cache).put(eq(relayState), any()); repository.loadAuthenticationRequest(request); - verify(cache).get("test", AbstractSaml2AuthenticationRequest.class); + verify(cache).get(relayState, AbstractSaml2AuthenticationRequest.class); repository.removeAuthenticationRequest(request, null); - verify(cache).evict("test"); + verify(cache).evict(relayState); } }