[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/errors.xml idp-saml-impl/src/main/java/ne...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Oct 27 22:26:06 2015
New Revision: 7890

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7890&view=rev
Log:
IDP-576 - Improve IdP SAML Logout default handling when client-side sessions are in use

Modified:
    trunk/idp-conf/src/main/resources/conf/errors.xml
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java
    trunk/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java

Modified: trunk/idp-conf/src/main/resources/conf/errors.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/errors.xml?rev=7890&r1=7889&r2=7890&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/errors.xml	(original)
+++ trunk/idp-conf/src/main/resources/conf/errors.xml	Tue Oct 27 22:26:06 2015
@@ -84,6 +84,7 @@
         
         <entry key="InvalidSubject" value-ref="shibboleth.SAML2Status.UnknownPrincipal" />
         <entry key="SubjectCanonicalizationError" value-ref="shibboleth.SAML2Status.UnknownPrincipal" />
+        <entry key="SessionNotFound" value-ref="shibboleth.SAML2Status.UnknownPrincipal" />
         
         <entry key="InvalidNameIDPolicy" value-ref="shibboleth.SAML2Status.InvalidNameIDPolicy" />
         

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java?rev=7890&r1=7889&r2=7890&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java	Tue Oct 27 22:26:06 2015
@@ -141,7 +141,7 @@
 
         nameIdentifier = msgCtx.getSubcontext(SAMLSubjectNameIdentifierContext.class, true).getSubjectNameIdentifier();
         if (nameIdentifier == null) {
-            log.debug("{} No Subject NameID or NameIdentifier in message", getLogPrefix());
+            log.debug("{} No Subject NameID/NameIdentifier in message needs inbound processing", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, NO_SUBJECT);
             return false;
         }

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java?rev=7890&r1=7889&r2=7890&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java	Tue Oct 27 22:26:06 2015
@@ -46,6 +46,7 @@
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
+import org.opensaml.saml.common.profile.SAMLEventIds;
 import org.opensaml.saml.ext.saml2aslo.Asynchronous;
 import org.opensaml.saml.saml2.core.LogoutRequest;
 import org.opensaml.saml.saml2.core.SessionIndex;
@@ -65,9 +66,10 @@
  * <p>A {@link SubjectContext} is also populated. If and only if a single {@link IdPSession} is resolved,
  * a {@link SessionContext} is also populated.</p>
  * 
- * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- * @event {@link org.opensaml.profile.action.EventIds#INVALID_PROFILE_CTX}
- * @event {@link org.opensaml.profile.action.EventIds#IO_ERROR}
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @event {@link EventIds#IO_ERROR}
+ * @event {@link SAMLEventIds#SESSION_NOT_FOUND}
  * @post The matching session(s) are destroyed.
  * @post If a {@link IdPSession} was found, then a {@link SubjectContext} and {@link LogoutContext} will be populated.
  * @post If a single {@link IdPSession} was found, then a {@link SessionContext} will be populated.
@@ -251,11 +253,6 @@
             final Iterable<IdPSession> sessions =
                     sessionResolver.resolve(sessionResolverCriteriaStrategy.apply(profileRequestContext));
             final Iterator<IdPSession> sessionIterator = sessions.iterator();
-            
-            if (!sessionIterator.hasNext()) {
-                log.info("{} No active session(s) found matching LogoutRequest", getLogPrefix());
-                return;
-            }
 

[... 107 lines stripped ...]