Skip to content

Commit 3fcda2c

Browse files
pitbulkpitbulk
authored
Merge pull request #81 from metal-hed/v2.0.0-Issue-80
Support IdPs with Service Single Logout for Requests/Responses splitted.
2 parents 6a36944 + 9ea3b49 commit 3fcda2c

11 files changed

Lines changed: 116 additions & 3 deletions

File tree

‎core/src/main/java/com/onelogin/saml2/logout/LogoutResponse.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ private StrSubstitutor generateSubstitutor(Saml2Settings settings) {
310310
valueMap.put("issueInstant", issueInstantString);
311311

312312
String destinationStr = "";
313-
URL slo = settings.getIdpSingleLogoutServiceUrl();
313+
URL slo = settings.getIdpSingleLogoutServiceResponseUrl();
314314
if (slo != null) {
315315
destinationStr = " Destination=\"" + slo.toString() + "\"";
316316
}

‎core/src/main/java/com/onelogin/saml2/settings/Saml2Settings.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ public class Saml2Settings {
4949
private URL idpSingleSignOnServiceUrl = null;
5050
private String idpSingleSignOnServiceBinding = Constants.BINDING_HTTP_REDIRECT;
5151
private URL idpSingleLogoutServiceUrl = null;
52+
private URL idpSingleLogoutServiceResponseUrl = null;
5253
private String idpSingleLogoutServiceBinding = Constants.BINDING_HTTP_REDIRECT;
5354
private X509Certificate idpx509cert = null;
5455
private String idpCertFingerprint = null;
@@ -167,6 +168,17 @@ public final URL getIdpSingleLogoutServiceUrl() {
167168
return idpSingleLogoutServiceUrl;
168169
}
169170

171+
/**
172+
* @return the idpSingleLogoutServiceResponseUrl setting value
173+
*/
174+
public final URL getIdpSingleLogoutServiceResponseUrl() {
175+
if (idpSingleLogoutServiceResponseUrl == null) {
176+
return getIdpSingleLogoutServiceUrl();
177+
}
178+
179+
return idpSingleLogoutServiceResponseUrl;
180+
}
181+
170182
/**
171183
* @return the idpSingleLogoutServiceBinding setting value
172184
*/
@@ -454,6 +466,17 @@ protected final void setIdpSingleLogoutServiceUrl(URL idpSingleLogoutServiceUrl)
454466
this.idpSingleLogoutServiceUrl = idpSingleLogoutServiceUrl;
455467
}
456468

469+
/**
470+
* Set the idpSingleLogoutServiceUrl setting value
471+
*
472+
* @param idpSingleLogoutServiceResponseUrl
473+
* the idpSingleLogoutServiceUrl value to be set
474+
*/
475+
protected final void setIdpSingleLogoutServiceResponseUrl(URL idpSingleLogoutServiceResponseUrl) {
476+
this.idpSingleLogoutServiceResponseUrl = idpSingleLogoutServiceResponseUrl;
477+
}
478+
479+
457480
/**
458481
* Set the idpSingleLogoutServiceBinding setting value
459482
*

‎core/src/main/java/com/onelogin/saml2/settings/SettingsBuilder.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ public class SettingsBuilder {
6161
public final static String IDP_SINGLE_SIGN_ON_SERVICE_URL_PROPERTY_KEY = "onelogin.saml2.idp.single_sign_on_service.url";
6262
public final static String IDP_SINGLE_SIGN_ON_SERVICE_BINDING_PROPERTY_KEY = "onelogin.saml2.idp.single_sign_on_service.binding";
6363
public final static String IDP_SINGLE_LOGOUT_SERVICE_URL_PROPERTY_KEY = "onelogin.saml2.idp.single_logout_service.url";
64+
public final static String IDP_SINGLE_LOGOUT_SERVICE_RESPONSE_URL_PROPERTY_KEY = "onelogin.saml2.idp.single_logout_service.response.url";
6465
public final static String IDP_SINGLE_LOGOUT_SERVICE_BINDING_PROPERTY_KEY = "onelogin.saml2.idp.single_logout_service.binding";
6566

6667
public final static String IDP_X509CERT_PROPERTY_KEY = "onelogin.saml2.idp.x509cert";
@@ -193,6 +194,10 @@ private void loadIdpSetting() {
193194
if (idpSingleLogoutServiceUrl != null)
194195
saml2Setting.setIdpSingleLogoutServiceUrl(idpSingleLogoutServiceUrl);
195196

197+
URL idpSingleLogoutServiceResponseUrl = loadURLProperty(IDP_SINGLE_LOGOUT_SERVICE_RESPONSE_URL_PROPERTY_KEY);
198+
if (idpSingleLogoutServiceResponseUrl != null)
199+
saml2Setting.setIdpSingleLogoutServiceResponseUrl(idpSingleLogoutServiceResponseUrl);
200+
196201
String idpSingleLogoutServiceBinding = loadStringProperty(IDP_SINGLE_LOGOUT_SERVICE_BINDING_PROPERTY_KEY);
197202
if (idpSingleLogoutServiceBinding != null)
198203
saml2Setting.setIdpSingleLogoutServiceBinding(idpSingleLogoutServiceBinding);

‎core/src/test/java/com/onelogin/saml2/test/settings/SettingBuilderTest.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ public void testLoadFromFileEmpty() throws IOException, CertificateException, UR
7272
assertNull(setting.getIdpSingleSignOnServiceUrl());
7373
assertEquals("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", setting.getIdpSingleSignOnServiceBinding());
7474
assertNull(setting.getIdpSingleLogoutServiceUrl());
75+
assertNull(setting.getIdpSingleLogoutServiceResponseUrl());
7576
assertEquals("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", setting.getIdpSingleLogoutServiceBinding());
7677
assertNull(setting.getIdpx509cert());
7778
assertNull(setting.getIdpCertFingerprint());
@@ -124,6 +125,7 @@ public void testLoadFromFileMinProp() throws IOException, CertificateException,
124125
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SSOService.php", setting.getIdpSingleSignOnServiceUrl().toString());
125126
assertEquals(setting.getIdpSingleSignOnServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
126127
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceUrl().toString());
128+
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceResponseUrl().toString());
127129
assertEquals(setting.getIdpSingleLogoutServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
128130
assertNotNull(setting.getIdpx509cert());
129131
assertEquals(Util.loadCert(Util.getFileAsString("certs/certificate1")), setting.getIdpx509cert());
@@ -177,6 +179,7 @@ public void testLoadFromFileAllProp() throws IOException, CertificateException,
177179
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SSOService.php", setting.getIdpSingleSignOnServiceUrl().toString());
178180
assertEquals(setting.getIdpSingleSignOnServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
179181
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceUrl().toString());
182+
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutServiceResponse.php", setting.getIdpSingleLogoutServiceResponseUrl().toString());
180183
assertEquals(setting.getIdpSingleLogoutServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
181184
assertNotNull(setting.getIdpx509cert());
182185
assertEquals(Util.loadCert(Util.getFileAsString("certs/certificate1")), setting.getIdpx509cert());
@@ -244,6 +247,7 @@ public void testLoadFromFileCertString() throws IOException, CertificateExceptio
244247
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SSOService.php", setting.getIdpSingleSignOnServiceUrl().toString());
245248
assertEquals("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", setting.getIdpSingleSignOnServiceBinding());
246249
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceUrl().toString());
250+
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceResponseUrl().toString());
247251
assertEquals("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", setting.getIdpSingleLogoutServiceBinding());
248252
assertEquals(Util.loadCert(Util.getFileAsString("certs/certificate1")), setting.getIdpx509cert());
249253

@@ -296,6 +300,7 @@ public void testLoadFromFileContactString() throws IOException, CertificateExcep
296300
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SSOService.php", setting.getIdpSingleSignOnServiceUrl().toString());
297301
assertEquals("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", setting.getIdpSingleSignOnServiceBinding());
298302
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceUrl().toString());
303+
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceResponseUrl().toString());
299304
assertEquals("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", setting.getIdpSingleLogoutServiceBinding());
300305
assertEquals(Util.loadCert(Util.getFileAsString("certs/certificate1")), setting.getIdpx509cert());
301306

@@ -375,6 +380,7 @@ public void testLoadFromFileSomeEmptyProp() throws IOException, CertificateExcep
375380
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SSOService.php", setting.getIdpSingleSignOnServiceUrl().toString());
376381
assertEquals(setting.getIdpSingleSignOnServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
377382
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceUrl().toString());
383+
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php", setting.getIdpSingleLogoutServiceResponseUrl().toString());
378384
assertEquals(setting.getIdpSingleLogoutServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
379385
assertNull(setting.getIdpx509cert());
380386
assertEquals("4b6f70bb2cab82c86a8270f71a880b62e25bc2b3", setting.getIdpCertFingerprint());
@@ -426,6 +432,7 @@ public void testLoadFromFileDifferentProp() throws IOException, CertificateExcep
426432
assertEquals("http://idp.example.com/simplesaml/saml2/idp/SSOService.php", setting.getIdpSingleSignOnServiceUrl().toString());
427433
assertEquals(setting.getIdpSingleSignOnServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
428434
assertNull(setting.getIdpSingleLogoutServiceUrl());
435+
assertNull(setting.getIdpSingleLogoutServiceResponseUrl());
429436
assertEquals(setting.getIdpSingleLogoutServiceBinding(), "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
430437
assertNull(setting.getIdpx509cert());
431438
assertEquals("00d84fd17802a1f1edd9a03447ca1d3a6c2101a610a164ab898b880d01c44190", setting.getIdpCertFingerprint());

‎core/src/test/resources/config/config.all.properties‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,11 @@ onelogin.saml2.idp.single_sign_on_service.binding = urn:oasis:names:tc:SAML:2.0:
5656
# URL Location of the IdP where the SP will send the SLO Request
5757
onelogin.saml2.idp.single_logout_service.url = http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php
5858

59+
# Optional SLO Response endpoint info of the IdP.
60+
# URL Location of the IdP where the SP will send the SLO Response. If left blank, same URL as onelogin.saml2.idp.single_logout_service.url will be used.
61+
# Some IdPs use a separate URL for sending a logout request and response, use this property to set the separate response url
62+
onelogin.saml2.idp.single_logout_service.response.url = http://idp.example.com/simplesaml/saml2/idp/SingleLogoutServiceResponse.php
63+
5964
# SAML protocol binding to be used when returning the <Response>
6065
# message. Onelogin Toolkit supports for this endpoint the
6166
# HTTP-Redirect binding only

‎core/src/test/resources/config/config.different.properties‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ onelogin.saml2.idp.single_sign_on_service.binding = urn:oasis:names:tc:SAML:2.0:
5757
# URL Location of the IdP where the SP will send the SLO Request
5858
onelogin.saml2.idp.single_logout_service.url = invalid_slo_url
5959

60+
# Optional SLO Response endpoint info of the IdP.
61+
# URL Location of the IdP where the SP will send the SLO Response. If left blank, same URL as onelogin.saml2.idp.single_logout_service.url will be used.
62+
# Some IdPs use a separate URL for sending a logout request and response, use this property to set the separate response url
63+
onelogin.saml2.idp.single_logout_service.response.url = invalid_slo_response_url
64+
6065
# SAML protocol binding to be used when returning the <Response>
6166
# message. Onelogin Toolkit supports for this endpoint the
6267
# HTTP-Redirect binding only

‎core/src/test/resources/config/config.somevaluesempty.properties‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ onelogin.saml2.idp.single_sign_on_service.binding = urn:oasis:names:tc:SAML:2.0:
5757
# URL Location of the IdP where the SP will send the SLO Request
5858
onelogin.saml2.idp.single_logout_service.url = http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php
5959

60+
# Optional SLO Response endpoint info of the IdP.
61+
# URL Location of the IdP where the SP will send the SLO Response. If left blank, same URL as onelogin.saml2.idp.single_logout_service.url will be used.
62+
# Some IdPs use a separate URL for sending a logout request and response, use this property to set the separate response url
63+
onelogin.saml2.idp.single_logout_service.response.url =
64+
6065
# SAML protocol binding to be used when returning the <Response>
6166
# message. Onelogin Toolkit supports for this endpoint the
6267
# HTTP-Redirect binding only

‎core/src/test/resources/onelogin.saml.properties‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,10 @@ onelogin.saml2.idp.single_sign_on_service.url = http://idp.example.com/simplesam
2222
# URL Location of the IdP where the SP will send the SLO Request
2323
onelogin.saml2.idp.single_logout_service.url = http://idp.example.com/simplesaml/saml2/idp/SingleLogoutService.php
2424

25+
# Optional SLO Response endpoint info of the IdP.
26+
# URL Location of the IdP where the SP will send the SLO Response. If left blank, same URL as onelogin.saml2.idp.single_logout_service.url will be used.
27+
# Some IdPs use a separate URL for sending a logout request and response, use this property to set the separate response url
28+
onelogin.saml2.idp.single_logout_service.response.url =
29+
2530
# Public x509 certificate of the IdP
2631
onelogin.saml2.idp.x509cert = -----BEGIN CERTIFICATE-----\nMIIBrTCCAaGgAwIBAgIBATADBgEAMGcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUwEwYDVQQHDAxTYW50YSBNb25pY2ExETAPBgNVBAoMCE9uZUxvZ2luMRkwFwYDVQQDDBBhcHAub25lbG9naW4uY29tMB4XDTEwMTAxMTIxMTUxMloXDTE1MTAxMTIxMTUxMlowZzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcMDFNhbnRhIE1vbmljYTERMA8GA1UECgwIT25lTG9naW4xGTAXBgNVBAMMEGFwcC5vbmVsb2dpbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMPmjfjy7L35oDpeBXBoRVCgktPkLno9DOEWB7MgYMMVKs2B6ymWQLEWrDugMK1hkzWFhIb5fqWLGbWy0J0veGR9/gHOQG+rD/I36xAXnkdiXXhzoiAG/zQxM0edMOUf40n314FC8moErcUg6QabttzesO59HFz6shPuxcWaVAgxAgMBAAEwAwYBAAMBAA==\n-----END CERTIFICATE-----

‎samples/java-saml-jspsample/src/main/resources/onelogin.saml.properties‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,11 @@ onelogin.saml2.idp.single_sign_on_service.binding = urn:oasis:names:tc:SAML:2.0:
6565
# URL Location of the IdP where the SP will send the SLO Request
6666
onelogin.saml2.idp.single_logout_service.url =
6767

68+
# Optional SLO Response endpoint info of the IdP.
69+
# URL Location of the IdP where the SP will send the SLO Response. If left blank, same URL as onelogin.saml2.idp.single_logout_service.url will be used.
70+
# Some IdPs use a separate URL for sending a logout request and response, use this property to set the separate response url
71+
onelogin.saml2.idp.single_logout_service.response.url =
72+
6873
# SAML protocol binding to be used when returning the <Response>
6974
# message. Onelogin Toolkit supports for this endpoint the
7075
# HTTP-Redirect binding only

‎toolkit/src/main/java/com/onelogin/saml2/Auth.java‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,13 @@ public String getSLOurl() {
356356
return settings.getIdpSingleLogoutServiceUrl().toString();
357357
}
358358

359+
/**
360+
* @return The url of the Single Logout Service Response.
361+
*/
362+
public String getSLOResponseUrl() {
363+
return settings.getIdpSingleLogoutServiceResponseUrl().toString();
364+
}
365+
359366
/**
360367
* Process the SAML Response sent by the IdP.
361368
*
@@ -476,7 +483,7 @@ public void processSLO(Boolean keepLocalSession, String requestId) throws Except
476483
parameters.put("Signature", signature);
477484
}
478485

479-
String sloUrl = getSLOurl();
486+
String sloUrl = getSLOResponseUrl();
480487
LOGGER.debug("Logout response sent to " + sloUrl + " --> " + samlLogoutResponse);
481488
ServletUtils.sendRedirect(response, sloUrl, parameters);
482489
}

0 commit comments

Comments
 (0)