Handling a parameter to logout flow

[Ralf Becker]

Hi,

(this is in reply to a conversation I’ve found at
 http://shibboleth.1660669.n2.nabble.com/Handling-a-parameter-to-logout-flow-td7625983.html)


I've got the same problem, but another (cleaner?) way to make the return parameter work in IdP 3.2.1.

The main problem seems to be, that "$flowExecutionUrl&_eventId=proceed“ is read into an hidden iframe.
As result the return-URL will be „displayed“ inside of this hidden iframe.
Smart redirecting the top window to "$flowExecutionUrl&_eventId=proceed“ may be a solution.

IN SHORT

Replace 
<iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed“>
by
<script> window.top.location = "$flowExecutionUrl&_eventId=proceed“; </script>


IN DETAIL

* Create file views/logout-finish.vm with
{{{
#if ( $logoutContext and !$logoutContext.getSessionMap().isEmpty() )
    <div id="confirm"></div>
    <script>
    <!--
    function confirmed() { window.top.location = "$flowExecutionUrl&_eventId=proceed"; }
    // tracked so far?
    function tracked() {
        var tracked = 0;
        for (j in sessionTracker)
            for (i in sessionTracker[j])
                if (i.startsWith("_")) tracked++;
        return tracked;
    }
    var track_timer = setInterval(function() {

        // break if not ready
        if (tracked() < jQuery("iframe").length) return;

        // give time to read, than handle what ever
        clearInterval(track_timer);
        document.getElementById("confirm").innerHTML =
            '<button onClick="confirmed()">OK</button>';
        setTimeout(confirmed, 5000);
    }, 1000);
    //-->
    </script>
#else
    <div id="confirm"><button onClick="confirmed()">OK</button></div>
    <script>
    <!--
    function confirmed() { window.top.location = "$flowExecutionUrl&_eventId=proceed"; }
    setTimeout(confirmed, 5000);
    //-->
    </script>
#end
}}}


* Modify file views/logout.vm
{{{
...
                <!-- If SAML logout with no extra work to do, complete the flow by adding a hidden iframe. -->
                #if ( $profileRequestContext.getProfileId().contains("saml2/logout") )
                    #parse("logout-finish.vm")
                    #*<iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed">*#
                #end
...
}}}

* Modify system/views/logout/propagate.vm
{{{
<!-- If SAML logout, complete the flow by adding a hidden iframe. -->
#if ( $profileRequestContext.getProfileId().contains("saml2/logout") )
    #parse("logout-finish.vm")
    #*<iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed">*#
#end
}}}


Using #parse("logout-finish.vm") may be a good way to make the finishing of a SAML SLO request customizable. 

What's your opinion on that? 

Regards Ralf

-- 

Ralf Becker, M. Sc., Dipl.-Inform. (FH) 
Netzwerke und Kommunikation
Rechenzentrum (Computing Center)
Hochschule Trier - Trier University of Applied Sciences
Schneidershof, D-54293 Trier

beckerr at hochschule-trier.de
http://www.hochschule-trier.de/~beckerr
tel:+49-651-8103-499 fax:-214

--

Wenn Gott gewollt hätte, dass E-Mail in HTML geschrieben
würden, endeten Gebete traditionell mit </amen>. (Tom Listen)