[java-idp-oidc] 02/03: JOIDC-13 - Support for OIDC Logout

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-13
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=92460662b9c1405ba081f83375be682a8e5ae833

commit 92460662b9c1405ba081f83375be682a8e5ae833
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 24 13:56:43 2023 +0200

    JOIDC-13 - Support for OIDC Logout
    
    https://shibboleth.atlassian.net/browse/JOIDC-13
    
    Modified end-session flow to redirect to IdP's Logout-flow whenever the query is empty
    or no id_token_hint nor client_id parameter is involved. That means that the flow has no
    means to discover for which RP the request is related to.
    
    The OIDC conformance tests require that in those cases the OP should still make sure that
    the user is logged out from OP.
---
 .../shibboleth/idp/flows/oidc/end-session/end-session-flow.xml   | 9 ++++++++-
 .../idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java      | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
index 5fb4815c..4b3bb3a7 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
@@ -10,8 +10,13 @@
         <evaluate expression="FlowStartPopulateAuditContext" />
         <evaluate expression="'proceed'" />
         
-        <transition on="proceed" to="DecodeMessage" />
+        <transition on="proceed" to="IsEmptyQuery" />
     </action-state>
+    
+    <decision-state id="IsEmptyQuery">
+        <if test="flowRequestContext.getExternalContext().getNativeRequest().getQueryString() == null or (flowRequestContext.getExternalContext().getNativeRequest().getParameter('id_token_hint') == null and flowRequestContext.getExternalContext().getNativeRequest().getParameter('client_id') == null)"
+            then="RedirectToGenericLogout" else="DecodeMessage" />
+    </decision-state>
 
     <action-state id="DecodeMessage">
         <evaluate expression="DecodeMessage" />
@@ -267,6 +272,8 @@
         <exception-handler bean="RethrowingFlowExecutionExceptionHandler" />
     </end-state>
 
+    <end-state id="RedirectToGenericLogout" view="externalRedirect:contextRelative:/profile/Logout" />
+
     <end-state id="end" />
    
     <bean-import resource="end-session-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
index 3c2a3238..769aa376 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
@@ -100,7 +100,7 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
         initializeThreadLocals();
 
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        Assert.assertEquals("ErrorView", result.getOutcome().getId());
+        Assert.assertEquals("RedirectToGenericLogout", result.getOutcome().getId());
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.