[java-idp-oidc] branch main updated: JOIDC-13 - Support for OIDC Logout

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=0c1266ed6f15ff12d7bac5eadb3c7fcd53e8f98f

The following commit(s) were added to refs/heads/main by this push:
     new 0c1266ed JOIDC-13 - Support for OIDC Logout
0c1266ed is described below

commit 0c1266ed6f15ff12d7bac5eadb3c7fcd53e8f98f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 23 16:48:48 2024 +0200

    JOIDC-13 - Support for OIDC Logout
    
    https://shibboleth.atlassian.net/browse/JOIDC-13
    
    Refactored the end-session flow to have LogoutCompleteView as view-state instead
    of end-state. This way it corresponds to the SAML SLO flow and the flow can proceed
    with possible redirection to the RP post logout redirection URI.
---
 .../idp/flows/oidc/end-session/end-session-flow.xml | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
index 2c6cf210..a9ad01c8 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
@@ -187,20 +187,23 @@
         <transition on="proceed" to="PopulateOutboundInterceptContext" />
     </view-state>
 
-    <end-state id="LogoutCompleteView" view="logout-complete">
+    <view-state id="LogoutCompleteView" view="logout-complete">
+        <attribute name="csrf_excluded" value="true" type="boolean"/>
         <on-entry>
             <evaluate expression="environment" result="viewScope.environment" />
-            <evaluate expression="opensamlProfileRequestContext" result="requestScope.profileRequestContext" />
-            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.LogoutContext))" result="requestScope.logoutContext" />
-            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.MultiRelyingPartyContext))" result="requestScope.multiRPContext" />
+            <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.LogoutContext))" result="viewScope.logoutContext" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.MultiRelyingPartyContext))" result="viewScope.multiRPContext" />
             <evaluate expression="opensamlProfileRequestContext.ensureOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCRpInitiatedLogoutContext))" result="viewScope.oidcRpInitiatedLogoutContext" />
             <evaluate expression="opensamlProfileRequestContext.ensureOutboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCRpInitiatedLogoutContext)).getPostLogoutRedirectUri()" result="viewScope.postLogoutRedirectUri" />
-            <evaluate expression="T(net.shibboleth.shared.codec.HTMLEncoder)" result="requestScope.encoder" />
-            <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="requestScope.request" />
-            <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="requestScope.response" />
-            <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="requestScope.custom" />
+            <evaluate expression="T(net.shibboleth.shared.codec.HTMLEncoder)" result="viewScope.encoder" />
+            <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
+            <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
+            <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
         </on-entry>
-    </end-state>
+
+        <transition on="proceed" to="PopulateOutboundInterceptContext" />
+    </view-state>
 
     <action-state id="PopulateOutboundInterceptContext">
         <evaluate expression="PopulateOutboundInterceptContext" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.