Package net.shibboleth.idp.plugin.oidc.op.logout.profile.impl

Class ProcessRpInitiatedLogoutRequest

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction<LogoutRequest>

net.shibboleth.idp.plugin.oidc.op.logout.profile.impl.AbstractOIDCRpInitiatedLogoutAction

net.shibboleth.idp.plugin.oidc.op.logout.profile.impl.ProcessRpInitiatedLogoutRequest

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, org.springframework.beans.factory.Aware, org.springframework.context.MessageSource, org.springframework.context.MessageSourceAware, org.springframework.webflow.execution.Action

public class ProcessRpInitiatedLogoutRequest
extends AbstractOIDCRpInitiatedLogoutAction

Profile action that processes LogoutRequest and OIDCRpInitiatedLogoutContext by resolving matching sessions and populating the associated SPSession objects into a LogoutContext. The session that initiated the process is included in the context only if OIDCRPSession.supportsLogoutPropagation() returns true.

A SubjectContext is also populated. If and only if a single IdPSession is resolved, a SessionContext is also populated.

Each SPSession is also assigned a unique number and inserted into the map returned by LogoutContext.getKeyedSessionMap().

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, EventIds.INVALID_MESSAGE, EventIds.IO_ERROR, OidcEventIds.SESSION_NOT_FOUND

Postcondition:

If at least one IdPSession was found, then a SubjectContext and LogoutContext will be populated., If a single IdPSession was found, then a SessionContext will be populated.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,ClientID>	issuerLookupStrategy	Lookup function for issuer.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,LogoutContext>	logoutContextCreationStrategy	Creation/lookup function for LogoutContext.
private Function<ProfileRequestContext,BiPredicate<String,SPSession>>	logoutHintMatchingStrategyLookupStrategy	Lookup function for the RP-initiated logout's logout_hint parameter matching against SPSession.
private Function<ProfileRequestContext,SessionContext>	sessionContextCreationStrategy	Creation/lookup function for SessionContext.
private SessionResolver	sessionResolver	Session resolver.
private Function<ProfileRequestContext,CriteriaSet>	sessionResolverCriteriaStrategy	Function to return CriteriaSet to give to session resolver.
private Function<ProfileRequestContext,SubjectContext>	subjectContextCreationStrategy	Creation/lookup function for SubjectContext.

Constructor Summary

Constructors

Constructor	Description
ProcessRpInitiatedLogoutRequest()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
private boolean	sessionMatches(ProfileRequestContext profileRequestContext, IdPSession session)	Check if the session contains a OIDCRPSession with the appropriate service ID and SessionIndex.
private boolean	sessionMatches(ProfileRequestContext profileRequestContext, SPSession session)	Check if the OIDCRPSession has the appropriate service ID and SessionIndex.
void	setIssuerLookupStrategy(Function<ProfileRequestContext,ClientID> strategy)	Set the issuer lookup strategy.
void	setLogoutContextCreationStrategy(Function<ProfileRequestContext,LogoutContext> strategy)	Set the creation/lookup strategy for the LogoutContext to populate.
void	setLogoutHintMatchingStrategyLookupStrategy(Function<ProfileRequestContext,BiPredicate<String,SPSession>> strategy)	Set the lookup function to the RP-initiated logout's logout_hint parameter matching against SPSession.
void	setSessionContextCreationStrategy(Function<ProfileRequestContext,SessionContext> strategy)	Set the creation/lookup strategy for the SessionContext to populate.
void	setSessionResolver(SessionResolver resolver)	Set the SessionResolver to use.
void	setSessionResolverCriteriaStrategy(Function<ProfileRequestContext,CriteriaSet> strategy)	Set the strategy for building the CriteriaSet to feed into the SessionResolver.
void	setSubjectContextCreationStrategy(Function<ProfileRequestContext,SubjectContext> strategy)	Set the creation/lookup strategy for the SubjectContext to populate.

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.logout.profile.impl.AbstractOIDCRpInitiatedLogoutAction

doPreExecute, getLogoutRequest, getMetadataContext, getRpInitiatedLogoutContext, setOIDCMetadataContextLookupStrategy, setOIDCRpInitatedLogoutCtxLookupStrategy

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCRequestAction

getRequest

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

sessionResolver

@NonnullAfterInit
private SessionResolver sessionResolver

Session resolver.

subjectContextCreationStrategy

@Nonnull
private Function<ProfileRequestContext,SubjectContext> subjectContextCreationStrategy

Creation/lookup function for SubjectContext.

sessionContextCreationStrategy

@Nonnull
private Function<ProfileRequestContext,SessionContext> sessionContextCreationStrategy

Creation/lookup function for SessionContext.

logoutContextCreationStrategy

@Nonnull
private Function<ProfileRequestContext,LogoutContext> logoutContextCreationStrategy

Creation/lookup function for LogoutContext.

issuerLookupStrategy

@Nonnull
private Function<ProfileRequestContext,ClientID> issuerLookupStrategy

Lookup function for issuer.

sessionResolverCriteriaStrategy

@Nonnull
private Function<ProfileRequestContext,CriteriaSet> sessionResolverCriteriaStrategy

Function to return CriteriaSet to give to session resolver.

logoutHintMatchingStrategyLookupStrategy

@Nonnull
private Function<ProfileRequestContext,BiPredicate<String,SPSession>> logoutHintMatchingStrategyLookupStrategy

Lookup function for the RP-initiated logout's logout_hint parameter matching against SPSession.

Constructor Details

ProcessRpInitiatedLogoutRequest

public ProcessRpInitiatedLogoutRequest()

Constructor.

Method Details

setSessionResolver

public void setSessionResolver(@Nonnull
 SessionResolver resolver)

Set the SessionResolver to use.

Parameters:

resolver - session resolver to use

setSubjectContextCreationStrategy

public void setSubjectContextCreationStrategy(@Nonnull
 Function<ProfileRequestContext,SubjectContext> strategy)

Set the creation/lookup strategy for the SubjectContext to populate.

Parameters:

strategy - creation/lookup strategy

setSessionContextCreationStrategy

public void setSessionContextCreationStrategy(@Nonnull
 Function<ProfileRequestContext,SessionContext> strategy)

Set the creation/lookup strategy for the SessionContext to populate.

Parameters:

strategy - creation/lookup strategy

setLogoutContextCreationStrategy

public void setLogoutContextCreationStrategy(@Nonnull
 Function<ProfileRequestContext,LogoutContext> strategy)

Set the creation/lookup strategy for the LogoutContext to populate.

Parameters:

strategy - creation/lookup strategy

setIssuerLookupStrategy

public void setIssuerLookupStrategy(@Nonnull
 Function<ProfileRequestContext,ClientID> strategy)

Set the issuer lookup strategy.

Parameters:

strategy - lookup strategy

setSessionResolverCriteriaStrategy

public void setSessionResolverCriteriaStrategy(@Nonnull
 Function<ProfileRequestContext,CriteriaSet> strategy)

Set the strategy for building the CriteriaSet to feed into the SessionResolver.

Parameters:

strategy - building strategy

setLogoutHintMatchingStrategyLookupStrategy

public void setLogoutHintMatchingStrategyLookupStrategy(@Nonnull
 Function<ProfileRequestContext,BiPredicate<String,SPSession>> strategy)

Set the lookup function to the RP-initiated logout's logout_hint parameter matching against SPSession.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

sessionMatches

private boolean sessionMatches(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 IdPSession session)

Check if the session contains a OIDCRPSession with the appropriate service ID and SessionIndex.

Parameters:

profileRequestContext - current profile request context

session - IdPSession to check

Returns:

true iff the set of SPSessions includes one applicable to the logout request

sessionMatches

private boolean sessionMatches(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 SPSession session)

Check if the OIDCRPSession has the appropriate service ID and SessionIndex.

Parameters:

profileRequestContext - current profile request context

session - SPSession to check

Returns:

true iff the SPSession directly matches the logout request