[java-identity-provider COMMIT] /trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml

[noreply at shibboleth.net]

Author: scantor
Date: Tue Apr 19 16:41:28 2016
New Revision: 8205

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8205&view=rev
Log:
IDP-867 - Allow for no return endpoint when Asynchronous SLO extension used

https://issues.shibboleth.net/jira/browse/IDP-867

Modified:
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml?rev=8205&r1=8204&r2=8205&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	Tue Apr 19 16:41:28 2016
@@ -19,19 +19,25 @@
     -->
     
     <!--
-    We splice into the parent flow by checking for a LogoutResponse after the inbound
-    message subflow runs, to bypass the rest of the parent flow. Anything else passes
-    control back to the next parent state. 
+    We splice into the parent flow by checking for a LogoutResponse or an Async LogoutRequest
+    after the inbound message subflow runs, to bypass the rest of the parent flow. Anything else
+    passes control back to the next parent state. 
     -->
     <subflow-state id="DoInboundInterceptSubflow">
         <transition on="proceed" to="CheckLogoutResponse" />
     </subflow-state>
     
     <decision-state id="CheckLogoutResponse">
+        <if test="opensamlProfileRequestContext.getInboundMessageContext().getMessage() instanceof T(org.opensaml.saml.saml2.core.LogoutResponse)"
+            then="LogoutResponseView" else="CheckAsync1"/>
+    </decision-state>
+
+    <decision-state id="CheckAsync1">
         <!-- If parent DoInboundInterceptSubflow transition changes on 'proceed', the else clause needs to also change. -->
-        <if test="opensamlProfileRequestContext.getInboundMessageContext().getMessage() instanceof T(org.opensaml.saml.saml2.core.LogoutResponse)"
-            then="LogoutResponseView" else="OutboundContextsAndSecurityParameters"/>
-    </decision-state>
+        <if test="opensamlProfileRequestContext.getInboundMessageContext().getMessage() instanceof T(org.opensaml.saml.saml2.core.LogoutRequest) and opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions() != null and !opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions().getUnknownXMLObjects(T(org.opensaml.saml.ext.saml2aslo.Asynchronous).DEFAULT_ELEMENT_NAME).isEmpty()"
+            then="ExtractSubject" else="OutboundContextsAndSecurityParameters" />
+    </decision-state>
+    
 
     <!-- LogoutRequest handling starts by loading client storage if needed. -->
         
@@ -107,7 +113,7 @@
             <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
         </on-render>
         
-        <transition on="proceed" to="CheckAsync" />
+        <transition on="proceed" to="CheckAsync2" />
         <transition on="propagate" to="LogoutPropagateView" />
         <transition on="end" to="LogoutCompleteView" />
     </view-state>
@@ -128,7 +134,7 @@
             <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
         </on-render>
         
-        <transition on="proceed" to="CheckAsync" />
+        <transition on="proceed" to="CheckAsync2" />
     </view-state>
 
     <view-state id="LogoutCompleteView" view="logout-complete">
@@ -143,10 +149,10 @@
             <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
         </on-render>
 
-        <transition on="proceed" to="CheckAsync" />
+        <transition on="proceed" to="CheckAsync2" />
     </view-state>
     
-    <decision-state id="CheckAsync">
+    <decision-state id="CheckAsync2">
         <if test="opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions() == null or opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions().getUnknownXMLObjects(T(org.opensaml.saml.ext.saml2aslo.Asynchronous).DEFAULT_ELEMENT_NAME).isEmpty()"
             then="BuildResponse" else="AsyncLogoutView" />
     </decision-state>