[java-oidc-common] branch main updated: JCOMOIDC-170 - Profile configuration setting for custom post logout redirect URI validation
Codeberg
noreply at shibboleth.net
Wed Jun 24 09:19:27 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/d61969f7f3dc7da2b407898e6af0f4907b894975
The following commit(s) were added to refs/heads/main by this push:
new d61969f7 JCOMOIDC-170 - Profile configuration setting for custom post logout redirect URI validation
d61969f7 is described below
commit d61969f7f3dc7da2b407898e6af0f4907b894975
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jun 24 12:16:10 2026 +0300
JCOMOIDC-170 - Profile configuration setting for custom post logout redirect URI validation
https://shibboleth.atlassian.net/browse/JCOMOIDC-170
- Add 'customPostLogoutRedirectUriValidationStrategy' for OIDC.Logout
- BiPredicate<URI,ProfileRequestContext>
---
.../config/OIDCLogoutProfileConfiguration.java | 14 ++++++
...edirectUriValidationStrategyLookupFunction.java | 56 ++++++++++++++++++++++
.../impl/DefaultOIDCLogoutConfiguration.java | 42 ++++++++++++++++
3 files changed, 112 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
index 91e25cf6..a0d68da6 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.profile.config;
+import java.net.URI;
import java.util.function.BiPredicate;
import javax.annotation.Nonnull;
@@ -88,4 +89,17 @@ public interface OIDCLogoutProfileConfiguration extends OAuth2TokenEncryptionPro
@Nullable BiPredicate<String,SPSession> getLogoutHintMatchingStrategy(
@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get the bi-predicate for validating post logout redirect URI in request to the current profile request context
+ * state.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-predicate for validating requested post logout redirect URI
+ *
+ * @since 3.4.0
+ */
+ @ConfigurationSetting(name="customPostLogoutRedirectUriValidationStrategy")
+ @Nullable BiPredicate<URI,ProfileRequestContext> getCustomPostLogoutRedirectUriValidationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/CustomPostLogoutRedirectUriValidationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/CustomPostLogoutRedirectUriValidationStrategyLookupFunction.java
new file mode 100644
index 00000000..bf5e8080
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/CustomPostLogoutRedirectUriValidationStrategyLookupFunction.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.net.URI;
+import java.util.function.BiPredicate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.config.OIDCLogoutProfileConfiguration;
+
+/**
+ * A function that returns
+ * {@link OIDCLogoutProfileConfiguration#getCustomPostLogoutRedirectUriValidationStrategy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 3.4.0
+ */
+public class CustomPostLogoutRedirectUriValidationStrategyLookupFunction extends
+ AbstractRelyingPartyLookupFunction<BiPredicate<URI,ProfileRequestContext>> {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public BiPredicate<URI,ProfileRequestContext> apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDCLogoutProfileConfiguration olpc) {
+ return olpc.getCustomPostLogoutRedirectUriValidationStrategy(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
index 5bca0286..48222c88 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.profile.config.impl;
+import java.net.URI;
import java.util.function.BiPredicate;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -64,6 +65,14 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
/** Lookup function to the RP-initiated logout's logout_hint parameter. */
@Nonnull
private Function<ProfileRequestContext,BiPredicate<String,SPSession>> logoutHintMatchingStrategyLookupStrategy;
+
+ /**
+ * Lookup function to supply strategy bi-predicate for custom valdation of post logout redirect URI in the request.
+ */
+ @Nonnull
+ private Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>>
+ customPostLogoutRedirectUriValidationStrategyLookupStrategy;
+
/**
* Constructor.
*/
@@ -85,6 +94,7 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
revokeTokensPredicate = PredicateSupport.alwaysTrue();
requireIdTokenHintPredicate = PredicateSupport.alwaysTrue();
logoutHintMatchingStrategyLookupStrategy = FunctionSupport.constant((str, session) -> false);
+ customPostLogoutRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
}
@Override @Nullable @NotEmpty
@@ -257,4 +267,36 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
Constraint.isNotNull(strategy, "Require id_token_hint predicate lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public BiPredicate<URI,ProfileRequestContext> getCustomPostLogoutRedirectUriValidationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return customPostLogoutRedirectUriValidationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-predicate for custom validation of post logout redirect URI in the request.
+ * .
+ * @param strategy bi-predicate for custom validation of post logout redirect URI in the request
+ *
+ * @since 3.4.0
+ */
+ public void setCustomPostLogoutRedirectUriValidationStrategy(
+ @Nullable final BiPredicate<URI,ProfileRequestContext> strategy) {
+ customPostLogoutRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-predicate for custom validation of post logout redirect URI in the request.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.4.0
+ */
+ public void setCustomPostLogoutRedirectUriValidationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>> strategy) {
+ customPostLogoutRedirectUriValidationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list