[java-identity-provider COMMIT] in /trunk: idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/Service.java idp-...

[noreply at shibboleth.net]

Author: serac
Date: Thu Jun 18 09:45:53 2015
New Revision: 7573

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7573&view=rev
Log:
IDP-645 Make CAS SP session tracking optional.

https://issues.shibboleth.net/jira/browse/IDP-645
Session tracking is a key requirement for SLO, but ought to be configurable
as a function of relying party. That behavior is consistent with the SAML
SSO profiles.

Modified:
    trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/Service.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/UpdateIdPSessionWithSPSessionAction.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/PatternServiceRegistry.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/ServiceDefinition.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ServiceValidateFlowTest.java
    trunk/idp-conf/src/test/resources/test/test-cas-beans.xml

Modified: trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/Service.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/Service.java?rev=7573&r1=7572&r2=7573&view=diff
==============================================================================
--- trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/Service.java	(original)
+++ trunk/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/Service.java	Thu Jun 18 09:45:53 2015
@@ -44,8 +44,12 @@
     /** Proxy authorization flag. */
     private final boolean authorizedToProxy;
 
+    /** Indicates whether a service wants to receive SLO messages. */
+    private final boolean singleLogoutParticipant;
+
+
     /**
-     * Creates a new service from given URL and group name.
+     * Creates a new service that does not participate in SLO.
      *
      * @param url CAS service URL.
      * @param group Group to which service belongs.
@@ -55,9 +59,26 @@
             @Nonnull @NotEmpty final String url,
             @Nullable @NotEmpty final String group,
             final boolean proxy) {
+        this(url, group, proxy, false);
+    }
+
+    /**
+     * Creates a new service that MAY participate in SLO.
+     *
+     * @param url CAS service URL.
+     * @param group Group to which service belongs.
+     * @param proxy True to authorize proxying, false otherwise.
+     * @param wantsSLO True to indicate the service wants to receive SLO messages, false otherwise.
+     */
+    public Service(
+            @Nonnull @NotEmpty final String url,
+            @Nullable @NotEmpty final String group,
+            final boolean proxy,
+            final boolean wantsSLO) {
         this.serviceURL = Constraint.isNotNull(StringSupport.trimOrNull(url), "Service URL cannot be null or empty");
         this.group = StringSupport.trimOrNull(group);
         this.authorizedToProxy = proxy;
+        this.singleLogoutParticipant = wantsSLO;
     }
 
     /** @return Service URL. */
@@ -77,6 +98,11 @@
         return authorizedToProxy;
     }
 
+    /** @return True to indicate the service wants to receive SLO messages, false otherwise. */
+    public boolean isSingleLogoutParticipant() {
+        return singleLogoutParticipant;
+    }
+
     @Override
     public String toString() {
         return serviceURL;

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/UpdateIdPSessionWithSPSessionAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/UpdateIdPSessionWithSPSessionAction.java?rev=7573&r1=7572&r2=7573&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/UpdateIdPSessionWithSPSessionAction.java	(original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/UpdateIdPSessionWithSPSessionAction.java	Thu Jun 18 09:45:53 2015
@@ -22,7 +22,6 @@
 import net.shibboleth.idp.cas.session.CASSPSession;
 import net.shibboleth.idp.cas.ticket.Ticket;
 import net.shibboleth.idp.cas.ticket.TicketContext;
-import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.session.IdPSession;
 import net.shibboleth.idp.session.SPSession;
 import net.shibboleth.idp.session.SessionException;
@@ -39,12 +38,16 @@
 import javax.annotation.Nonnull;
 
 /**
- * Updates the {@link net.shibboleth.idp.session.IdPSession} with a {@link CASSPSession} that describes the service
- * granted access to and the ticket that was successfully validated to grant access.
+ * Conditionally updates the {@link net.shibboleth.idp.session.IdPSession} with a {@link CASSPSession} to support SLO.
+ * If the service granted access to indicates participation in SLO via {@link Service#singleLogoutParticipant},
+ * then a {@link CASSPSession} is created to track the SP session in order that it may receive SLO messages upon
+ * a request to the CAS <code>/logout</code> URI.
+ * <p>
  * Requires the following to be available under the {@link ProfileRequestContext}:
  * <ul>

[... 218 lines stripped ...]