[java-idp-oidc] 01/02: JOIDC-13 - Support for OIDC Logout

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-13
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=722e9a2a14b9b9459faa907551461500aaed6f06

commit 722e9a2a14b9b9459faa907551461500aaed6f06
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Oct 19 15:42:14 2023 +0300

    JOIDC-13 - Support for OIDC Logout
    
    https://shibboleth.atlassian.net/browse/JOIDC-13
    
    Implement and wire default logout hint to session ID matching strategy.
---
 .../logic/DefaultLogoutHintMatchingPredicate.java  | 39 ++++++++++++++++++++++
 .../idp/service/relying-party/postconfig.xml       |  4 +++
 2 files changed, 43 insertions(+)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultLogoutHintMatchingPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultLogoutHintMatchingPredicate.java
new file mode 100644
index 00000000..fbee8a4a
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultLogoutHintMatchingPredicate.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.logic;
+
+import java.util.function.BiPredicate;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.session.SPSession;
+
+/**
+ * Default validation strategy for logout hints. This simply checks if the String given in the input
+ * parameters matches with {@link SPSession#getSPSessionKey}.
+ * 
+ * @since 4.1.0
+ */
+public class DefaultLogoutHintMatchingPredicate implements BiPredicate<String, SPSession> {
+
+    @Override
+    public boolean test(@Nullable final String logoutHint, @Nullable final SPSession spSession) {
+        if (logoutHint == null || spSession == null) {
+            return false;
+        }
+        return logoutHint.equals(spSession.getSPSessionKey());
+    }
+
+}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 7b305bc0..98fa2e60 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -75,9 +75,13 @@
     <bean id="OIDC.Logout" parent="AbstractOIDCProfile" lazy-init="true"
           class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCLogoutConfiguration"
           p:issuer-ref="shibboleth.oidc.issuer"
+          p:logoutHintMatchingStrategy-ref="%{idp.oidc.logout.logoutHintMatchingStrategy:DefaultLogoutHintMatchingPredicate}"
           p:securityConfiguration-ref="%{idp.security.oidc.logout.config:shibboleth.oidc.logout.DefaultSecurityConfiguration}" />
         <!-- TODO: default values via configuration properties once the set is final -->
 
+    <bean id="DefaultLogoutHintMatchingPredicate"
+          class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultLogoutHintMatchingPredicate"/>
+
     <!-- Metadata-driven variants. -->
     
     <bean id="AbstractMDDrivenOIDCProfile" parent="AbstractMDDrivenProfile" abstract="true">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.