Zoom Integration with Shibboleth IdP v3 and non-signed logout request

[Scott Koranda]

> But for explanation's sake, the rules that run are in something called the "inbound interceptor" subflow and the ID of that flow is defaulted in all the profile config beans in relying-party-system.xml, so that's the pointer to what the built in behavior is.
>
> <bean id="SAML2.Logout"
>         class="net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration"
>         p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
>         p:inboundInterceptorFlows="security-policy/saml2-slo"
>         p:encryptionOptional="%{idp.encryption.optional:false}" />
>
>
> That flow definition is in system/flows/saml/saml2/slo-security-flow.xml
>
> Obviously that flow can be changed in a brute force way by editing files in system/ but changing them so they'll generally work across upgrades involves copying it into a user flow and then overriding that flow ID in your profile config beans:
>
>     <bean parent="SAML2.Logout"
>         p:inboundInterceptorFlows="my-security-policy/saml2-slo" />
>
> You would create a copy of the flow in conf/flows/my-security-policy/saml2-slo/saml2-slo-flow.xml and adjust it by commenting out or deleting specific rules (in this case CheckMandatoryAuthentication).

I made the copy:

# cat conf/flows/my-security-policy/saml2-slo/saml2-slo-flow.xml
<flow xmlns="http://www.springframework.org/schema/webflow"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/webflow
http://www.springframework.org/schema/webflow/spring-webflow.xsd"
    parent="security-policy.abstract">

    <action-state id="SAML2SLOSecurityPolicy">
        <evaluate expression="ReceivedEndpointSecurityHandler" />
        <evaluate expression="MessageReplaySecurityHandler" />
        <evaluate expression="MessageLifetimeSecurityHandler" />
        <evaluate expression="SAMLMDClientCertAuthSecurityHandler" />
        <evaluate expression="SAMLProtocolMessageXMLSignatureSecurityHandler" />
        <evaluate
expression="SAML2HTTPRedirectDeflateSignatureSecurityHandler" />
        <evaluate expression="SAML2HTTPPostSimpleSignSecurityHandler" />
        <evaluate expression="CheckMandatoryIssuer" />
        <evaluate expression="ExtractChannelBindingsExtensionsHandler" />
        <evaluate expression="'proceed'" />

        <transition on="proceed" to="proceed" />
    </action-state>

    <bean-import resource="../../../../system/flows/saml/security-beans.xml" />

</flow>

and in conf/relying-party.xml I have this for the specific SP:

<util:list id="shibboleth.RelyingPartyOverrides">

        <bean parent="RelyingPartyByName"
c:relyingPartyIds="https://example.edu/shibboleth">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.Logout"
p:inboundInterceptorFlows="my-security-policy/saml2-slo" />
                </list>
            </property>
        </bean>

    </util:list>

I see, however, this error:

2015-04-17 23:09:53,307 - ERROR
[net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:129]
- Profile Action PopulateProfileInterceptorContext: Configured
interceptor flow intercept/my-security-policy/saml2-slo not available
for use

I have tried a few different paths like
conf/flows/intercept/my-security-policy/saml2-slo/saml2-slo-flow.xml
but I have not been able to get rid of that error.

Thoughts?

Thanks,

Scott K