[java-oidc-common] branch main updated: JCOMOIDC-171 - Profile configuration setting for ignoring invalid post logout redirect URI

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/66d7050c4161c7fe5626891aea5014475bed23cf

The following commit(s) were added to refs/heads/main by this push:
     new 66d7050c JCOMOIDC-171 - Profile configuration setting for ignoring invalid post logout redirect URI
66d7050c is described below

commit 66d7050c4161c7fe5626891aea5014475bed23cf
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jun 24 15:02:52 2026 +0300

    JCOMOIDC-171 - Profile configuration setting for ignoring invalid post logout redirect URI
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-171
    
    Add 'ignoreInvalidPostLogoutRedirectUri' for OIDC.Logout
---
 .../config/OIDCLogoutProfileConfiguration.java     | 13 ++++++
 ...gnoreInvalidPostLogoutRedirectUriPredicate.java | 47 ++++++++++++++++++++++
 .../impl/DefaultOIDCLogoutConfiguration.java       | 35 ++++++++++++++++
 3 files changed, 95 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
index a0d68da6..7d25863d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
@@ -102,4 +102,17 @@ public interface OIDCLogoutProfileConfiguration extends OAuth2TokenEncryptionPro
     @ConfigurationSetting(name="customPostLogoutRedirectUriValidationStrategy")
     @Nullable BiPredicate<URI,ProfileRequestContext> getCustomPostLogoutRedirectUriValidationStrategy(
             @Nullable final ProfileRequestContext profileRequestContext);
+
+    /**
+     * Get whether to ignore invalid post logout redirect URI in the request.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return true if an invalid post logout redirect URI is to be ignored
+     * 
+     * @since 3.4.0
+     */
+    @ConfigurationSetting(name="ignoreInvalidPostLogoutRedirectUri")
+    boolean isIgnoreInvalidPostLogoutRedirectUri(@Nullable final ProfileRequestContext profileRequestContext);
+
 }
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IgnoreInvalidPostLogoutRedirectUriPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IgnoreInvalidPostLogoutRedirectUriPredicate.java
new file mode 100644
index 00000000..e3b1abd4
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IgnoreInvalidPostLogoutRedirectUriPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.config.OIDCLogoutProfileConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OIDCLogoutProfileConfiguration#isIgnoreInvalidPostLogoutRedirectUri(ProfileRequestContext)}.
+ * 
+ * @since 3.4.0
+ */
+public class IgnoreInvalidPostLogoutRedirectUriPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    @Override
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof OIDCLogoutProfileConfiguration olpc) {
+                return olpc.isIgnoreInvalidPostLogoutRedirectUri(input);
+            }
+        }
+        return false;
+    }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
index 48222c88..9b7ce38c 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
@@ -73,6 +73,9 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
     private Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>>
         customPostLogoutRedirectUriValidationStrategyLookupStrategy;
 
+    /** Whether to ignore invalid post logout redirect URI in RP-initiated logout parameters. */
+    @Nonnull private Predicate<ProfileRequestContext> ignoreInvalidPostLogoutRedirectUriPredicate;
+
     /**
      * Constructor.
      */
@@ -95,6 +98,7 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
         requireIdTokenHintPredicate = PredicateSupport.alwaysTrue();
         logoutHintMatchingStrategyLookupStrategy = FunctionSupport.constant((str, session) -> false);
         customPostLogoutRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
+        ignoreInvalidPostLogoutRedirectUriPredicate = PredicateSupport.alwaysFalse();
     }
 
     @Override @Nullable @NotEmpty
@@ -299,4 +303,35 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
                 "Lookup strategy cannot be null");
     }
 
+    @Override
+    public boolean isIgnoreInvalidPostLogoutRedirectUri(@Nullable final ProfileRequestContext profileRequestContext) {
+        return ignoreInvalidPostLogoutRedirectUriPredicate.test(profileRequestContext);
+    }
+
+    /**
+     * Set whether to ignore an invalid post logout redirect URI in an OIDC RP-initiated logout sequence.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 3.4.0
+     */
+    public void setIgnoreInvalidPostLogoutRedirectUri(final boolean flag) {
+        ignoreInvalidPostLogoutRedirectUriPredicate =
+                flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+    }
+
+    /**
+     * Set a condition to determine whether to ignore an invalid post logout redirect URI in an OIDC RP-initiated
+     * logout sequence.
+     *
+     * @param condition condition to set
+     * 
+     * @since 3.4.0
+     */
+    public void setIgnoreInvalidPostLogoutRedirectUriPredicate(
+            @Nonnull final Predicate<ProfileRequestContext> condition) {
+        ignoreInvalidPostLogoutRedirectUriPredicate =
+                Constraint.isNotNull(condition, "Ignore invalid post logout redirect URI predicate cannot be null");
+    }
+
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.