[java-identity-provider COMMIT] /trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml

[noreply at shibboleth.net]

Author: scantor
Date: Tue Oct 18 11:15:24 2016
New Revision: 8504

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8504&view=rev
Log:
IDP-1067 - Async LogoutRequest fails with EncryptedID

https://issues.shibboleth.net/jira/browse/IDP-1067

Modified:
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml?rev=8504&r1=8503&r2=8504&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	Tue Oct 18 11:15:24 2016
@@ -35,8 +35,16 @@
     <decision-state id="CheckAsync1">
         <!-- If parent DoInboundInterceptSubflow transition changes on 'proceed', the else clause needs to also change. -->
         <if test="opensamlProfileRequestContext.getInboundMessageContext().getMessage() instanceof T(org.opensaml.saml.saml2.core.LogoutRequest) and opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions() != null and !opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions().getUnknownXMLObjects(T(org.opensaml.saml.ext.saml2aslo.Asynchronous).DEFAULT_ELEMENT_NAME).isEmpty()"
-            then="ExtractSubject" else="OutboundContextsAndSecurityParameters" />
-    </decision-state>
+            then="AsyncDecryptionParameters" else="OutboundContextsAndSecurityParameters" />
+    </decision-state>
+    
+    <!-- This is the one action inside "OutboundContextsAndSecurityParameters" that we can't skip. -->
+    <action-state id="AsyncDecryptionParameters">
+        <evaluate expression="PopulateDecryptionParameters" />
+        <evaluate expression="'proceed'" />
+        
+        <transition on="proceed" to="ExtractSubject" />
+    </action-state>
     
 
     <!-- LogoutRequest handling starts by loading client storage if needed. -->