[cpp-sp] branch master updated: CPPOST-112 - Implement message correlation in SAML2 encoder/decoder

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=bca6eb66ffebbd1acb6b1ef46e50458f4eb4d613

The following commit(s) were added to refs/heads/master by this push:
       new  bca6eb6   CPPOST-112 - Implement message correlation in SAML2 encoder/decoder
bca6eb6 is described below

commit bca6eb66ffebbd1acb6b1ef46e50458f4eb4d613
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 25 20:18:11 2020 -0500

    CPPOST-112 - Implement message correlation in SAML2 encoder/decoder
    
    https://issues.shibboleth.net/jira/browse/CPPOST-112
    
    Handle cases with no relay state using a special sentry value.
---
 shibsp/handler/impl/AbstractHandler.cpp      | 13 +++++++++++--
 shibsp/handler/impl/SAML2LogoutInitiator.cpp |  4 ++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/shibsp/handler/impl/AbstractHandler.cpp b/shibsp/handler/impl/AbstractHandler.cpp
index d21c42c..63dea8b 100644
--- a/shibsp/handler/impl/AbstractHandler.cpp
+++ b/shibsp/handler/impl/AbstractHandler.cpp
@@ -243,9 +243,12 @@ void Handler::cleanRelayState(
 
 void Handler::preserveRelayState(const Application& application, HTTPResponse& response, string& relayState) const
 {
-    // The empty string implies no state to deal with.
-    if (relayState.empty())
+    // The empty string implies no state to deal with but we need to generate a correlation handle.
+    if (relayState.empty()) {
+        generateRandomHex(relayState, 4);
+        relayState = "corr:" + lexical_cast<string>(time(nullptr)) + '_' + relayState;
         return;
+    }
 
     // No setting means just pass state by value.
     pair<bool,const char*> mech = getString("relayState");
@@ -329,6 +332,12 @@ void Handler::recoverRelayState(
 {
     SPConfig& conf = SPConfig::getConfig();
 
+    // Sentry value that signifies it was only a correlation tool.
+    if (starts_with(relayState, "corr:")) {
+        relayState.clear();
+        return;
+    }
+
     // Look for StorageService-backed state of the form "ss:SSID:key".
     const char* state = relayState.c_str();
     if (strstr(state,"ss:") == state) {
diff --git a/shibsp/handler/impl/SAML2LogoutInitiator.cpp b/shibsp/handler/impl/SAML2LogoutInitiator.cpp
index 02cb220..f9e8162 100644
--- a/shibsp/handler/impl/SAML2LogoutInitiator.cpp
+++ b/shibsp/handler/impl/SAML2LogoutInitiator.cpp
@@ -459,9 +459,9 @@ pair<bool,long> SAML2LogoutInitiator::doRequest(
             application.limitRedirect(httpRequest, returnloc);
             relayState = returnloc;
             httpRequest.absolutize(relayState);
-            cleanRelayState(application, httpRequest, httpResponse);
-            preserveRelayState(application, httpResponse, relayState);
         }
+        cleanRelayState(application, httpRequest, httpResponse);
+        preserveRelayState(application, httpResponse, relayState);
 
         auto_ptr<LogoutRequest> msg(buildRequest(application, *session, *role, ep->getLocation(), encoder));
         msg->setDestination(ep->getLocation());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.