[java-plugin-shibd-saml] branch main updated: Bug fixes and more tests for logout response issuance.
Codeberg
noreply at shibboleth.net
Thu May 28 14:20:55 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/7383cbae3947e48a660d95a879ba1947a1feb91e
The following commit(s) were added to refs/heads/main by this push:
new 7383cba Bug fixes and more tests for logout response issuance.
7383cba is described below
commit 7383cbae3947e48a660d95a879ba1947a1feb91e
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu May 28 10:20:40 2026 -0400
Bug fixes and more tests for logout response issuance.
---
.../flows/sp/logout/consumer/saml2/saml2-beans.xml | 4 ++
.../flows/sp/logout/consumer/saml2/saml2-flow.xml | 1 +
.../saml2/SAML2LogoutConsumerTokenFlowTest.java | 61 ++++++++++++++++++++--
3 files changed, 62 insertions(+), 4 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
index 3b477e3..33c5c01 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
@@ -193,6 +193,10 @@
</property>
</bean>
+ <bean id="CreateServletResponse"
+ class="net.shibboleth.sp.profile.impl.CreateOutputMessage" scope="prototype"
+ p:createServletResponse="true" />
+
<bean id="AddLogoutResponse"
class="net.shibboleth.sp.saml.saml2.profile.impl.AddLogoutResponse" scope="prototype" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml
index d424765..24dfc46 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml
@@ -78,6 +78,7 @@
<evaluate expression="InitializeMessageChannelSecurityContext" />
<evaluate expression="PopulateBindingAndEndpointContexts" />
<evaluate expression="PopulateResponseSignatureSigningParameters" />
+ <evaluate expression="CreateServletResponse" />
<evaluate expression="AddLogoutResponse" />
<evaluate expression="HandleOutboundMessage" />
<evaluate expression="EncodeMessage" />
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerTokenFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerTokenFlowTest.java
index 24402a3..25bcd9b 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerTokenFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutConsumerTokenFlowTest.java
@@ -27,6 +27,7 @@ import org.opensaml.messaging.decoder.MessageDecodingException;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.common.binding.SAMLBindingSupport;
import org.opensaml.saml.common.profile.SAMLEventIds;
import org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder;
import org.opensaml.saml.saml2.core.Issuer;
@@ -43,6 +44,7 @@ import org.testng.Assert;
import org.testng.annotations.AfterClass;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -94,8 +96,11 @@ public class SAML2LogoutConsumerTokenFlowTest extends AbstractSPFlowTest {
/** Flow ID. */
@Nonnull public static final String FLOW_ID = "sp/logout-consumer";
+ /** SP entityID value. */
+ @Nonnull public static final String SP_ENTITY_ID = "https://testsp.example.org";
+
/** Issuer value. */
- @Nonnull public static final String ISSUER = "https://testsp.example.org";
+ @Nonnull public static final String ISSUER = "https://idp.example.org";
/** No endpoint Issuer value. */
@Nonnull public static final String NO_ENDPOINT_ISSUER = "https://noendpoint.example.org";
@@ -232,18 +237,61 @@ public class SAML2LogoutConsumerTokenFlowTest extends AbstractSPFlowTest {
assertOutputMessageEvent(result, SAMLEventIds.ENDPOINT_RESOLUTION_FAILED);
}
+ /**
+ * Test baseic success case.
+ *
+ * @param success input parameter for flow
+ * @param code status code to check for
+ * @param requestID request ID for InResponseTo
+ * @param relayState relay state value
+ *
+ * @throws Exception
+ */
+ @Test(dataProvider="statuses")
+ public void testSuccess(final int success, @Nonnull final String code, @Nonnull final String requestID,
+ @Nullable final String relayState) throws Exception {
+ final DDF input = new DDF(null).structure();
+ input.addmember(ConsumerConstants.TOKEN_PARAM).string(buildToken(ISSUER, requestID, relayState));
+ input.addmember(ConsumerConstants.SUCCESS_PARAM).integer(success);
+ setApplicationRequest("default", input);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertFlowExecutionResult(result, FLOW_ID);
+ assertFlowExecutionOutcome(result.getOutcome());
+ assertOutputMessageSuccess(result);
+ validateOutputMessage(result, code, requestID, relayState);
+ }
+
+ @DataProvider(name = "statuses")
+ public Object[][] getStatuses() throws Exception {
+ return new Object[][] {
+ new Object[] {
+ Integer.valueOf(1), StatusCode.SUCCESS, "12345", null
+ },
+ new Object[] {
+ Integer.valueOf(0), StatusCode.RESPONDER, "12345", null
+ },
+ new Object[] {
+ Integer.valueOf(1), StatusCode.SUCCESS, "12345", "foo"
+ },
+ };
+ }
+
/**
* Decode an encoded response and run sanity checks against it.
*
* @param result flow execution result
* @param statusCode status code to check for
+ * @param requestID original request ID
+ * @param relayState relay state to check for
*
* @return the response object
*
* @throws MessageDecodingException
*/
@Nonnull private LogoutResponse validateOutputMessage(@Nonnull final FlowExecutionResult result,
- @Nullable final String statusCode) throws MessageDecodingException {
+ @Nullable final String statusCode, @Nullable final String requestID, @Nullable final String relayState)
+ throws MessageDecodingException {
final ProfileRequestContext prc = retrieveProfileRequestContext(result);
assert prc != null;
@@ -271,15 +319,20 @@ public class SAML2LogoutConsumerTokenFlowTest extends AbstractSPFlowTest {
final Object saml = prc.ensureOutboundMessageContext().ensureMessage();
assert saml instanceof LogoutResponse;
logoutResponse = (LogoutResponse) saml;
+ Assert.assertTrue(logoutResponse.isSigned());
}
+ Assert.assertEquals(SAMLBindingSupport.getRelayState(prc.ensureOutboundMessageContext()), relayState);
+
assert logoutResponse != null;
Assert.assertNotNull(logoutResponse.getID());
+ Assert.assertEquals(logoutResponse.getInResponseTo(), requestID);
Assert.assertTrue(Instant.now().isAfter(logoutResponse.getIssueInstant()));
+
final Issuer issuer = logoutResponse.getIssuer();
assert issuer != null;
- Assert.assertEquals(issuer.getValue(), ISSUER);
-
+ Assert.assertEquals(issuer.getValue(), SP_ENTITY_ID);
+
final Status status = logoutResponse.getStatus();
assert status != null;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list