[java-plugin-shibd-saml] branch main updated: More tests, adjust property name for logout siging condition.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/559a9ad55d8080c4884b429454287db94bd6ea6b

The following commit(s) were added to refs/heads/main by this push:
     new 559a9ad  More tests, adjust property name for logout siging condition.
559a9ad is described below

commit 559a9ad55d8080c4884b429454287db94bd6ea6b
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon May 25 12:49:26 2026 -0400

    More tests, adjust property name for logout siging condition.
---
 .../flows/sp/logout/consumer/saml2/saml2-beans.xml |  2 +-
 .../shibboleth/idp/module/conf/sp/saml.properties  |  3 ++
 .../flows/saml2/SAML2LogoutConsumerFlowTest.java   | 45 +++++++++++++++++++---
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
index 6311e9a..ab04194 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
@@ -138,7 +138,7 @@
                         <bean class="org.opensaml.messaging.handler.impl.CheckMandatoryIssuer" scope="prototype"
                             p:issuerLookupStrategy-ref="InboundEntityIDLookup" />
                         <bean class="org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication" scope="prototype"
-                                p:activationCondition="%{idp.logout.authenticated:true}">
+                                p:activationCondition="%{sp.saml.logout.authenticated:true}">
                             <property name="authenticationLookupStrategy">
                                 <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextAuthenticationFunction" />
                             </property>
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index c4e252f..33387b0 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -67,6 +67,9 @@ sp.saml.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
 # Configures use of the Attribute Resolver for enrichment
 #sp.saml.resolveAttributes = false
 
+# Require signed logout requests/responses
+#sp.saml.logout.authenticated = true
+
 # Each protocol plugin will contain an order priority controlling
 # relative order of use when handling requests, lower is "earlier".
 #sp.saml.relativeOrder = 1
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerFlowTest.java
index dee9bee..0f9f1aa 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerFlowTest.java
@@ -233,36 +233,69 @@ public class SAML2LogoutConsumerFlowTest extends AbstractSPFlowTest {
     }
     
     /**
-     * Test flow with unverified (no metadata) IdP specified.
+     * Test flow with request with unverified (no metadata) IdP specified.
      * 
      * @throws IOException 
      */
     @Test
-    public void testUnverified() throws IOException {
+    public void testRequestUnverified() throws IOException {
         final DDF input = buildRemotedPOSTMessage(buildLogoutRequest(ISSUER + "/bad"), null, null);
         setApplicationRequest(APPLICATION_ID, input);
 
         validateError(IdPEventIds.INVALID_PROFILE_CONFIG);
     }
+     
+    /**
+     * Test LogoutRequest flow without an input session.
+     * 
+     * @throws Exception 
+     */
+    @Test
+    public void testRequestNoSession() throws Exception {
+        final LogoutRequest request = buildLogoutRequest(ISSUER);
+        sign(request);
+        final DDF input = buildRemotedPOSTMessage(request, null, null);
+        setApplicationRequest(APPLICATION_ID, input);
         
+        validateLogoutRequestResult(false);
+    }
+    
     /**
-     * Test successful flow.
+     * Test LogoutRequest flow without a match.
      * 
      * @throws Exception 
      */
     @Test
-    public void testSuccess() throws Exception {
+    public void testRequestNoMatch() throws Exception {
+        final LogoutRequest request = buildLogoutRequest(ISSUER);
+        sign(request);
+        final DDF input = buildRemotedPOSTMessage(request, null, null);
+        input.addmember(ConsumerConstants.SESSION_OPAQUE).addmember(PrepareAgentResponse.NAMEID_PARAM).string(
+                "<NameID xmlns='urn:oasis:names:tc:SAML:2.0:assertion'"
+                        + "' SPProvidedID='" + ISSUER + "'>jdoe at example.org</NameID>");
+        setApplicationRequest(APPLICATION_ID, input);
+        
+        validateLogoutRequestResult(false);
+    }
+    
+    /**
+     * Test LogoutRequest flow with a match.
+     * 
+     * @throws Exception 
+     */
+    @Test
+    public void testRequestSuccess() throws Exception {
         final LogoutRequest request = buildLogoutRequest(ISSUER);
         sign(request);
         final DDF input = buildRemotedPOSTMessage(request, null, null);
         input.addmember(ConsumerConstants.SESSION_OPAQUE).addmember(PrepareAgentResponse.NAMEID_PARAM).string(
                 "<NameID xmlns='urn:oasis:names:tc:SAML:2.0:assertion' Format='"
                         + NameIDType.EMAIL + "' SPProvidedID='" + ISSUER + "'>jdoe at example.org</NameID>");
-        setApplicationRequest(APPLICATION_ID, input);        
+        setApplicationRequest(APPLICATION_ID, input);
         
         validateLogoutRequestResult(true);
     }
-
+    
     /**
      * Examine a flow response to a valid LogoutRequest for accuracy.
      * 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.