[java-idp-oidc] branch main updated: JOIDC-13 - Support for OIDC Logout

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=170fcf0dec8fd396997df3d60d41215bd5d3e87d

The following commit(s) were added to refs/heads/main by this push:
     new 170fcf0d JOIDC-13 - Support for OIDC Logout
170fcf0d is described below

commit 170fcf0dec8fd396997df3d60d41215bd5d3e87d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 22 13:44:01 2024 +0200

    JOIDC-13 - Support for OIDC Logout
    
    https://shibboleth.atlassian.net/browse/JOIDC-13
    
    Allow logout token type header customization via shibboleth.oidc.logout.LogoutTokenTypeLookupStrategy.
---
 .../oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java | 1 +
 .../idp/flows/logoutprop/oidc/oidc-logout-propagation-beans.xml      | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java
index 97cbb8fd..b751cabb 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java
@@ -160,6 +160,7 @@ public class ExecuteBackChannelLogoutRequest extends AbstractOIDCBackChannelLogo
 
         final List<NameValuePair> nvps = new ArrayList<>();
         nvps.add(new BasicNameValuePair("logout_token", logoutToken.serialize()));
+        log.trace("{} Logout token to be used in the request: {}", getLogPrefix(), logoutToken.serialize());
         final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(nvps, StandardCharsets.UTF_8);
         httpRequest.setEntity(urlEncodedFormEntity);
 
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/logoutprop/oidc/oidc-logout-propagation-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/logoutprop/oidc/oidc-logout-propagation-beans.xml
index cfa85a7d..18f9bddc 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/logoutprop/oidc/oidc-logout-propagation-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/logoutprop/oidc/oidc-logout-propagation-beans.xml
@@ -84,6 +84,9 @@
           p:xmlSafeIdentifier="%{idp.oidc.xmlSafeIdentifiers:true}"
           p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"/>
 
+    <bean id="DefaultLogoutTokenTypeLookupStrategy" parent="shibboleth.Functions.Constant"
+        c:target="logout+jwt"/>
+
     <bean id="SignBackChannelLogoutToken"
           class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
           scope="prototype"
@@ -93,7 +96,7 @@
                   class="net.shibboleth.oidc.security.impl.SignJWTHandler"
                   scope="prototype"
                   p:logName="BC Logout Token"
-                  p:typeHeader="logout+jwt">
+                  p:typeHeaderLookupStrategy="#{getObject('shibboleth.oidc.logout.LogoutTokenTypeLookupStrategy') ?: getObject('DefaultLogoutTokenTypeLookupStrategy')}">
                 <property name="claimsToSignLookupStrategy">
                     <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromLogoutContextLookupFunction" />
                 </property>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.