[java-idp-oidc] 01/02: JOIDC-13 - Support for OIDC Logout

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-13
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=44e8d817e8e4daab8035f6c8c55bdb3b31b59225

commit 44e8d817e8e4daab8035f6c8c55bdb3b31b59225
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 17 11:09:58 2023 +0200

    JOIDC-13 - Support for OIDC Logout
    
    https://shibboleth.atlassian.net/browse/JOIDC-13
    
    Fixed a typo in post logout redirect URI with state and added state
    population to the context.
---
 .../impl/PopulateRpInitiatedLogoutContext.java     |  5 ++++
 .../messaging/impl/RpInitiatedLogoutResponse.java  |  2 +-
 .../oidc/op/profile/flow/EndSessionFlowTest.java   | 28 ++++++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/PopulateRpInitiatedLogoutContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/PopulateRpInitiatedLogoutContext.java
index 4622b865..a8eeac65 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/PopulateRpInitiatedLogoutContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/PopulateRpInitiatedLogoutContext.java
@@ -26,6 +26,7 @@ import org.slf4j.LoggerFactory;
 import com.google.common.base.Predicates;
 import com.nimbusds.jwt.EncryptedJWT;
 import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.id.State;
 
 import net.shibboleth.oidc.profile.core.OidcEventIds;
 import net.shibboleth.shared.logic.Constraint;
@@ -90,5 +91,9 @@ public class PopulateRpInitiatedLogoutContext extends AbstractOIDCRpInitiatedLog
         }
         getRpInitiatedLogoutContext().setLogoutHint(StringSupport.trimOrNull(getLogoutRequest().getLogoutHint()));
         getRpInitiatedLogoutContext().setPostLogoutRedirectUri(getLogoutRequest().getPostLogoutRedirectionURI());
+        final State state = getLogoutRequest().getState();
+        if (state != null) {
+            getRpInitiatedLogoutContext().setState(state.getValue());
+        }
     }
 }
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/impl/RpInitiatedLogoutResponse.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/impl/RpInitiatedLogoutResponse.java
index c78a4148..97bbd3a3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/impl/RpInitiatedLogoutResponse.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/impl/RpInitiatedLogoutResponse.java
@@ -122,7 +122,7 @@ public class RpInitiatedLogoutResponse implements Response {
     @Nonnull
     protected String serializeParameters(@Nonnull final String prefix) throws UnsupportedEncodingException {
         if (state != null) {
-            return prefix + "state" + URLEncoder.encode(state, "UTF-8");
+            return prefix + "state=" + URLEncoder.encode(state, "UTF-8");
         }
         return prefix;
     }
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
index 5df919a8..3c2a3238 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
@@ -183,6 +183,34 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
         Assert.assertTrue(result2.isEnded());
     }
 
+    @Test
+    public void testWithClientIdAndSessionAndState_withPostLogoutRedirection() {
+        final String state = idGenerator.generateIdentifier();
+        setRequestParameters(List.of(
+                new Pair<>("client_id", clientId),
+                new Pair<>("logout_hint", sessionId),
+                new Pair<>("post_logout_redirect_uri", postLogoutRedirectUri),
+                new Pair<>("state", state)));
+        request.setMethod("GET");
+        storeMetadata(storageService, clientId, clientSecret, postLogoutRedirectUri);
+
+        initializeThreadLocals();
+        
+        final IdPSession session = buildIdPSessionWithDefaultSP();
+        request.setCookies(response.getCookies());
+        Assert.assertTrue(isSessionValid(session));
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        Assert.assertFalse(result.isEnded());
+        Assert.assertFalse(isSessionValid(session));
+        
+        ((MockParameterMap) externalContext.getRequestParameterMap()).put("_eventId", "proceed");
+        final FlowExecutionResult result2 = flowExecutor.resumeExecution(result.getPausedKey(), externalContext);
+        Assert.assertFalse(isSessionValid(session));
+        Assert.assertEquals(response.getStatus(), 302);
+        Assert.assertEquals(response.getHeaderValue("Location"), postLogoutRedirectUri + "?state=" + state);
+        Assert.assertTrue(result2.isEnded());
+    }
+
     @Test
     public void testWithInvalidIdTokenHint() {
         setRequestParameters(List.of(new Pair<>("id_token_hint", "not a JWT")));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.