[java-identity-provider COMMIT] /trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml

[noreply at shibboleth.net]

Author: scantor
Date: Mon Nov  2 17:48:52 2015
New Revision: 7918

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7918&view=rev
Log:
IDP-224 - Bypass outbound context and inbound Subject work for a LogoutResponse.

Modified:
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml?rev=7918&r1=7917&r2=7918&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	Mon Nov  2 17:48:52 2015
@@ -18,14 +18,24 @@
     result compatible with the logout propagation flow contract.
     -->
     
-    <decision-state id="DoProfileWork">
+    <!--
+    We splice into the parent flow by checking for a LogoutResponse after the inbound
+    message subflow runs, to bypass the rest of the parent flow. Anything else passes
+    control back to the next parent state. 
+    -->
+    <subflow-state id="DoInboundInterceptSubflow">
+        <transition on="proceed" to="CheckLogoutResponse" />
+    </subflow-state>
+    
+    <decision-state id="CheckLogoutResponse">
+        <!-- If parent DoInboundInterceptSubflow transition changes on 'proceed', the else clause needs to also change. -->
         <if test="opensamlProfileRequestContext.getInboundMessageContext().getMessage() instanceof T(org.opensaml.saml.saml2.core.LogoutResponse)"
-            then="LogoutResponseView" else="PopulateClientStorageLoadContext"/>
-    </decision-state>
-
-    <!-- Load client storage if needed. -->
-    
-    <action-state id="PopulateClientStorageLoadContext">
+            then="LogoutResponseView" else="OutboundContextsAndSecurityParameters"/>
+    </decision-state>
+
+    <!-- LogoutRequest handling starts by loading client storage if needed. -->
+        
+    <action-state id="DoProfileWork">
         <evaluate expression="PopulateClientStorageLoadContext" />
         <evaluate expression="'proceed'" />