Zoom Integration with Shibboleth IdP v3 and non-signed logout request

[Scott Koranda]

On Sat, Apr 18, 2015 at 8:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 4/18/15, 2:23 AM, "Scott Koranda" <skoranda at gmail.com> wrote:
>>
>>I see, however, this error:
>>
>>2015-04-17 23:09:53,307 - ERROR
>>[net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:129]
>>- Profile Action PopulateProfileInterceptorContext: Configured
>>interceptor flow intercept/my-security-policy/saml2-slo not available
>>for use
>>
>>I have tried a few different paths like
>>conf/flows/intercept/my-security-policy/saml2-slo/saml2-slo-flow.xml
>>but I have not been able to get rid of that error.
>
> I missed a step, you also have to add a bean to intercept/profile-intercept.xml in the shibboleth.AvailableInterceptFlows list (the following should work):
>
> <bean id="intercept/my-security-policy/saml2-slo" parent="shibboleth.InterceptFlow" />
>
>

I am seeing this error now:

2015-04-19 18:04:27,220 - ERROR [net.shibboleth.idp.authn:-2] -
Uncaught runtime exception
org.springframework.webflow.definition.registry.NoSuchFlowDefinitionException:
No flow definition
'intercept/incoming-logout-request-no-signature-required/saml2-slo'
found
        at org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl.getFlowDefinitionHolder(FlowDefinitionRegistryImpl.java:123)

Here is what I have done so far:

1) Created conf/flows/incoming-logout-request-no-signature-required/saml2-slo/saml2-slo-flow.xml
with these contents:

# cat conf/flows/incoming-logout-request-no-signature-required/saml2-slo/saml2-slo-flow.xml
<flow xmlns="http://www.springframework.org/schema/webflow"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/webflow
http://www.springframework.org/schema/webflow/spring-webflow.xsd"
    parent="security-policy.abstract">

    <action-state id="SAML2SLOSecurityPolicy">
        <evaluate expression="ReceivedEndpointSecurityHandler" />
        <evaluate expression="MessageReplaySecurityHandler" />
        <evaluate expression="MessageLifetimeSecurityHandler" />
        <evaluate expression="SAMLMDClientCertAuthSecurityHandler" />
        <evaluate expression="SAMLProtocolMessageXMLSignatureSecurityHandler" />
        <evaluate
expression="SAML2HTTPRedirectDeflateSignatureSecurityHandler" />
        <evaluate expression="SAML2HTTPPostSimpleSignSecurityHandler" />
        <evaluate expression="CheckMandatoryIssuer" />
        <evaluate expression="ExtractChannelBindingsExtensionsHandler" />
        <evaluate expression="'proceed'" />

        <transition on="proceed" to="proceed" />
    </action-state>

    <bean-import resource="../../../../system/flows/saml/security-beans.xml" />

</flow>

2) Edited the file conf/intercept/profile-intercept.xml so that it reads

# cat conf/intercept/profile-intercept.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd

http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <bean id="shibboleth.AvailableInterceptFlows"
parent="shibboleth.DefaultInterceptFlows" lazy-init="true">
        <property name="sourceList">
            <list merge="true">
                <bean id="intercept/context-check"
parent="shibboleth.InterceptFlow" />

                <bean id="intercept/terms-of-use"
parent="shibboleth.consent.TermsOfUseFlow" />

                <bean id="intercept/attribute-release"
parent="shibboleth.consent.AttributeReleaseFlow" />

                <bean
id="intercept/incoming-logout-request-no-signature-required/saml2-slo"
parent="shibboleth.InterceptFlow" />
            </list>
        </property>
    </bean>

</beans>

3) Edited conf/relying-party.xml so that the override for the SP in question is

<bean parent="RelyingPartyByName"
c:relyingPartyIds="https://example.edu/shibboleth">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.Logout"
p:inboundInterceptorFlows="incoming-logout-request-no-signature-required/saml2-slo"
/>
                </list>
            </property>
        </bean>


What have I missed?

Thanks,

Scott K