8000 Close limited SOAP request streams in SAML endpoints by ahus1 · Pull Request #55171 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Close limited SOAP request streams in SAML endpoints #55171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahus1 merged 2 commits into from
Nov 13, 2026
+12 −4
Merged

Close limited SOAP request streams in SAML endpoints #55171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da4bbf8
Close limited SOAP request streams in SAML endpoints
ahus1 Nov 13, 2026
b9d8852
Refactor soapBinding method for simplified processing
ahus1 Nov 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
8000 Diff view
10 changes: 8 additions & 2 deletions services/src/main/java/org/keycloak/protocol/saml/SamlService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1210,7 +1210,13 @@ public AuthenticationSessionModel getOrCreateLoginSessionForIdpInitiatedSso(Keyc
@NoCache
@Consumes({"application/soap+xml", MediaType.TEXT_XML})
public Response artifactResolutionService(InputStream inputStream) {
Document soapBodyContents = Soap.extractSoapMessage(SamlProtocolUtils.limit(inputStream, maxSoapMessageRequestSize));
Document soapBodyContents;
try (InputStream limitedInputStream = SamlProtocolUtils.limit(inputStream, maxSoapMessageRequestSize)) {
soapBodyContents = Soap.extractSoapMessage(limitedInputStream);
} catch (IOException e) {
logger.debug("Error while closing the SOAP request stream", e);
return Soap.createFault().reason("").detail("").build();
}
ArtifactResolveType artifactResolveType = null;
SAMLDocumentHolder samlDocumentHolder = null;
try {
Expand Down Expand Up @@ -1262,7 +1268,7 @@ public Response artifactResolutionService(InputStream inputStream) {
public Response soapBinding(InputStream inputStream) {
SamlEcpProfileService bindingService = new SamlEcpProfileService(session, event, maxInflatingSize, destinationValidator, maxSoapMessageRequestSize, enableSaml11);

return bindingService.authenticate(SamlProtocolUtils.limit(inputStream, maxSoapMessageRequestSize));
return bindingService.authenticate(inputStream);
}

private ClientModel getAndCheckClientModel(String clientSessionId, String clientId) throws ProcessingException {
Expand Down
6 changes: 4 additions & 2 deletions services/src/main/java/org/keycloak/protocol/saml/profile/ecp/SamlEcpProfileService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,12 +67,14 @@ public SamlEcpProfileService(KeycloakSession session, EventBuilder event, long m
}

public Response authenticate(InputStream inputStream) {
try {
return authenticate(Soap.extractSoapMessage(SamlProtocolUtils.limit(inputStream, maxSoapMessageRequestSize)));
Document soapMessage;
try (InputStream limitedInputStream = SamlProtocolUtils.limit(inputStream, maxSoapMessageRequestSize)) {
soapMessage = Soap.extractSoapMessage(limitedInputStream);
} catch (Exception e) {
logger.debugf(e, "Error while processing SOAP request.");
return Soap.createFault().reason("Some error occurred while processing the SOAP request.").build();
}
return authenticate(soapMessage);
}

public Response authenticate(Document soapMessage) {
Expand Down
Loading
0