[java-idp-oidc] 10/14: JOIDC-13 - Support for OIDC Logout

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=dbae3ab367097350a3fe3357b99078992d3f5b0d

commit dbae3ab367097350a3fe3357b99078992d3f5b0d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 24 13:56:43 2023 +0200

    JOIDC-13 - Support for OIDC Logout
    
    https://shibboleth.atlassian.net/browse/JOIDC-13
    
    Modified end-session flow to redirect to IdP's Logout-flow whenever the query is empty
    or no id_token_hint nor client_id parameter is involved. That means that the flow has no
    means to discover for which RP the request is related to.
    
    The OIDC conformance tests require that in those cases the OP should still make sure that
    the user is logged out from OP.
---
 .../shibboleth/idp/flows/oidc/end-session/end-session-flow.xml   | 9 ++++++++-
 .../idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java      | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
index 5fb4815c..4b3bb3a7 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
@@ -10,8 +10,13 @@
         <evaluate expression="FlowStartPopulateAuditContext" />
         <evaluate expression="'proceed'" />
         
-        <transition on="proceed" to="DecodeMessage" />
+        <transition on="proceed" to="IsEmptyQuery" />
     </action-state>
+    
+    <decision-state id="IsEmptyQuery">
+        <if test="flowRequestContext.getExternalContext().getNativeRequest().getQueryString() == null or (flowRequestContext.getExternalContext().getNativeRequest().getParameter('id_token_hint') == null and flowRequestContext.getExternalContext().getNativeRequest().getParameter('client_id') == null)"
+            then="RedirectToGenericLogout" else="DecodeMessage" />
+    </decision-state>
 
     <action-state id="DecodeMessage">
         <evaluate expression="DecodeMessage" />
@@ -267,6 +272,8 @@
         <exception-handler bean="RethrowingFlowExecutionExceptionHandler" />
     </end-state>
 
+    <end-state id="RedirectToGenericLogout" view="externalRedirect:contextRelative:/profile/Logout" />
+
     <end-state id="end" />
    
     <bean-import resource="end-session-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
index 3c2a3238..769aa376 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/EndSessionFlowTest.java
@@ -100,7 +100,7 @@ public class EndSessionFlowTest extends AbstractOidcFlowTest {
         initializeThreadLocals();
 
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        Assert.assertEquals("ErrorView", result.getOutcome().getId());
+        Assert.assertEquals("RedirectToGenericLogout", result.getOutcome().getId());
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.