[cpp-sp COMMIT] in /branches/REL_2: schemas/shibboleth-2.0-native-sp-config.xsd shibsp/Application.cpp shibsp/Service...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Mar 27 20:18:47 2012
New Revision: 3601

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3601&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-396

Modified:
    branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
    branches/REL_2/shibsp/Application.cpp
    branches/REL_2/shibsp/ServiceProvider.cpp

Modified: branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd?rev=3601&r1=3600&r2=3601&view=diff
==============================================================================
--- branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd (original)
+++ branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd Tue Mar 27 20:18:47 2012
@@ -239,8 +239,10 @@
     <attribute name="authType" type="conf:string"/>
     <attribute name="requireSession" type="boolean"/>
     <attribute name="requireSessionWith" type="conf:string"/>
+    <attribute name="requireLogoutWith" type="anyURI"/>
     <attribute name="exportAssertion" type="boolean"/>
     <attribute name="exportStdVars" type="boolean"/>
+    <attribute name="exportCookie" type="boolean"/>
     <attribute name="redirectToSSL" type="unsignedInt"/>
     <attribute name="entityID" type="anyURI"/>
     <attribute name="discoveryURL" type="anyURI"/>

Modified: branches/REL_2/shibsp/Application.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/Application.cpp?rev=3601&r1=3600&r2=3601&view=diff
==============================================================================
--- branches/REL_2/shibsp/Application.cpp (original)
+++ branches/REL_2/shibsp/Application.cpp Tue Mar 27 20:18:47 2012
@@ -66,6 +66,8 @@
 
     if (lifetime)
         *lifetime = 0;
+    if (!prefix)
+        prefix = "";
     const PropertySet* props=getPropertySet("Sessions");
     if (props) {
         if (lifetime) {
@@ -78,12 +80,12 @@
             p.second=defProps;
         pair<bool,const char*> p2=props->getString("cookieName");
         if (p2.first)
-            return make_pair(string(prefix) + p2.second,p.second);
-        return make_pair(string(prefix) + getHash(),p.second);
+            return make_pair(string(prefix) + p2.second, p.second);
+        return make_pair(string(prefix) + getHash(), p.second);
     }
 
     // Shouldn't happen, but just in case..
-    return pair<string,const char*>(prefix,defProps);
+    return pair<string,const char*>(prefix, defProps);
 }
 
 void Application::clearHeader(SPRequest& request, const char* rawname, const char* cginame) const

Modified: branches/REL_2/shibsp/ServiceProvider.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/ServiceProvider.cpp?rev=3601&r1=3600&r2=3601&view=diff
==============================================================================
--- branches/REL_2/shibsp/ServiceProvider.cpp (original)
+++ branches/REL_2/shibsp/ServiceProvider.cpp Tue Mar 27 20:18:47 2012
@@ -149,6 +149,7 @@
 
     void SHIBSP_DLLLOCAL clearHeaders(SPRequest& request) {
         const Application& app = request.getApplication();
+        app.clearHeader(request, "Shib-Cookie-Name", "HTTP_SHIB_COOKIE_NAME");
         app.clearHeader(request, "Shib-Session-ID", "HTTP_SHIB_SESSION_ID");
         app.clearHeader(request, "Shib-Session-Index", "HTTP_SHIB_SESSION_INDEX");
         app.clearHeader(request, "Shib-Identity-Provider", "HTTP_SHIB_IDENTITY_PROVIDER");
@@ -268,10 +269,11 @@
                 return make_pair(true, request.returnOK());
         }
 
-        // Three settings dictate how to proceed.
+        // These settings dictate how to proceed.
         pair<bool,const char*> authType = settings.first->getString("authType");
         pair<bool,bool> requireSession = settings.first->getBool("requireSession");
         pair<bool,const char*> requireSessionWith = settings.first->getString("requireSessionWith");
+        pair<bool,const char*> requireLogoutWith = settings.first->getString("requireLogoutWith");
 
         // If no session is required AND the AuthType (an Apache-derived concept) isn't recognized,
         // then we ignore this request and consider it unprotected. Apache might lie to us if
@@ -294,7 +296,29 @@
                 throw;
         }
 
-        if (!session) {
+        if (session) {
+            // Check for logout interception.
+            if (requireLogoutWith.first) {
+                // Check for a completion parameter on the query string.
+                const char* qstr = request.getQueryString();
+                if (!qstr || !strstr(qstr, "shiblogoutdone=1")) {
+                    // First leg of circuit, so we redirect to the logout endpoint specified with this URL as a return location.
+                    string selfurl = request.getRequestURL();
+                    if (!qstr)
+                        selfurl += '?';
+                    selfurl += "shiblogoutdone=1";
+                    string loc = requireLogoutWith.second;
+                    request.absolutize(loc);
+                    if (loc.find('?') != string::npos)

[... 63 lines stripped ...]