[java-identity-provider] branch main updated: IDP-2244 - Logout flow completion logic in views is SAML-specific

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7e950641065c39736ffcfa86db759e957ec92e14

The following commit(s) were added to refs/heads/main by this push:
     new 7e9506410 IDP-2244 - Logout flow completion logic in views is SAML-specific
7e9506410 is described below

commit 7e950641065c39736ffcfa86db759e957ec92e14
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 14 13:13:27 2024 -0500

    IDP-2244 - Logout flow completion logic in views is SAML-specific
    
    https://shibboleth.atlassian.net/browse/IDP-2244
---
 .../shibboleth/idp/flows/logout/logout-flow.xml    |  4 ++--
 .../shibboleth/idp/module/views/logout-complete.vm |  4 ++--
 .../net/shibboleth/idp/views/logout/propagate.vm   |  4 ++--
 .../idp/session/context/LogoutContext.java         | 28 ++++++++++++++++++++++
 4 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/logout/logout-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/logout/logout-flow.xml
index 0ad62af6d..0530ad1ca 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/logout/logout-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/logout/logout-flow.xml
@@ -126,7 +126,7 @@
             <evaluate expression="SaveLogoutContext" />
             <evaluate expression="environment" result="requestScope.environment" />
             <evaluate expression="opensamlProfileRequestContext" result="requestScope.profileRequestContext" />
-            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.LogoutContext))" result="requestScope.logoutContext" />
+            <evaluate expression="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.session.context.LogoutContext)).setFlowComplete(true)" result="requestScope.logoutContext" />
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.MultiRelyingPartyContext))" result="requestScope.multiRPContext" />
             <evaluate expression="T(net.shibboleth.shared.codec.HTMLEncoder)" result="requestScope.htmlEncoder" />
             <evaluate expression="T(java.net.URLEncoder)" result="requestScope.urlEncoder" />
@@ -145,7 +145,7 @@
             <evaluate expression="WriteAuditLog" />
             <evaluate expression="environment" result="requestScope.environment" />
             <evaluate expression="opensamlProfileRequestContext" result="requestScope.profileRequestContext" />
-            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.LogoutContext))" result="requestScope.logoutContext" />
+            <evaluate expression="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.session.context.LogoutContext)).setFlowComplete(true)" result="requestScope.logoutContext" />
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.MultiRelyingPartyContext))" result="requestScope.multiRPContext" />
             <evaluate expression="T(net.shibboleth.shared.codec.HTMLEncoder)" result="requestScope.encoder" />
             <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CSPDigester')" result="requestScope.cspDigester" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm
index fcadf0c0f..7126a1eb6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/logout-complete.vm
@@ -49,8 +49,8 @@ $response.addHeader("Content-Security-Policy", "script-src 'none'; base-uri 'non
                     <li><a href="#springMessageText("idp.url.helpdesk", '#')">#springMessageText("idp.login.needHelp", "Need Help?")</a></li>
                 </ul>
                 
-              <!-- If SAML logout, complete the flow by adding a hidden iframe. -->
-              #if ( $profileRequestContext.getProfileId().contains("saml2/logout") )
+              <!-- If required, complete the flow by adding a hidden iframe. -->
+              #if (!$logoutContext.flowComplete)
                   <iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed"></iframe>
               #end
             </section>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm
index 8b2a454cf..70085c218 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm
@@ -171,7 +171,7 @@
     #end
 #end
 
-<!-- If SAML logout, complete the flow by adding a hidden iframe. -->
-#if ( $profileRequestContext.getProfileId().contains("saml2/logout") )
+<!-- If required, complete the flow by adding a hidden iframe. -->
+#if (!$logoutContext.flowComplete)
     <iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed"></iframe>
 #end
diff --git a/idp-session-api/src/main/java/net/shibboleth/idp/session/context/LogoutContext.java b/idp-session-api/src/main/java/net/shibboleth/idp/session/context/LogoutContext.java
index 175cd187f..d3cd7ea5d 100644
--- a/idp-session-api/src/main/java/net/shibboleth/idp/session/context/LogoutContext.java
+++ b/idp-session-api/src/main/java/net/shibboleth/idp/session/context/LogoutContext.java
@@ -46,6 +46,9 @@ public final class LogoutContext extends BaseContext {
 
     /** An index of the session objects by an externally assigned key. */
     @Nonnull private final Map<String,SPSession> keyedSessionMap;
+    
+    /** Signal that logout master flow is complete. */
+    private boolean flowComplete;
         
     /** Constructor. */
     public LogoutContext() {
@@ -96,4 +99,29 @@ public final class LogoutContext extends BaseContext {
         return sessionMap.get(id);
     }
     
+    /**
+     * Gets whether the master logout flow has completed or requires further signaling.
+     *
+     *  @return true iff the flow is completed
+     *  
+     *  @since 5.1.0
+     */
+    public boolean isFlowComplete() {
+        return flowComplete;
+    }
+    
+    /**
+     * Sets whether the master logout flow has completed or requires further signaling.
+     * 
+     * @param flag flag to set
+     * 
+     * @return this context
+     * 
+     * @since 5.1.0
+     */
+    @Nonnull public LogoutContext setFlowComplete(final boolean flag) {
+        flowComplete = flag;
+        
+        return this;
+    }
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.