SES-7: Single Logout

[spring-projects-issues]

Mandus Elfving (Migrated from SES-7) said:

Implement support for Single Logout.

According to the thread at http://jira.springframework.org/browse/SEC-1004 Aslak Knutsen has already implemented it and could maybe be contacted for a working implementation?

[spring-projects-issues]

Girish Kolantra Ramadevan said:

In AbstractProfileBase.java, the sendMessage method is written as follows

protected void sendMessage(boolean sign, SignableSAMLObject message, Endpoint endpoint, HttpServletResponse response) throws SAMLException, MessageEncodingException {

    BasicSAMLMessageContext<SAMLObject, SignableSAMLObject, SAMLObject> samlContext = new BasicSAMLMessageContext<SAMLObject, SignableSAMLObject, SAMLObject>();
    samlContext.setOutboundMessageTransport(new HttpServletResponseAdapter(response, false));
    samlContext.setOutboundSAMLMessage(message);
    samlContext.setPeerEntityEndpoint(endpoint);

    if (sign) {
        samlContext.setOutboundSAMLMessageSigningCredential(getSPSigningCredential());
    }

    MessageEncoder encoder = getEncoder(endpoint.getBinding());
    encoder.encode(samlContext);

}

In org.opensaml.saml2.binding.encoding.BaseSAML2MessageEncoder the getEndpointURL is written as

protected String getEndpointURL(SAMLMessageContext messageContext) throws MessageEncodingException {
Endpoint endpoint = messageContext.getPeerEntityEndpoint();
if (endpoint == null) {
throw new MessageEncodingException("Endpoint for relying party was null.");
}

    if (messageContext.getOutboundMessage() instanceof StatusResponseType
            && !DatatypeHelper.isEmpty(endpoint.getResponseLocation())) {
        return endpoint.getResponseLocation();
    } else {
        if (DatatypeHelper.isEmpty(endpoint.getLocation())) {
            throw new MessageEncodingException("Relying party endpoint location was null or empty.");
        }
        return endpoint.getLocation();
    }
}

If you notice, AbstractProfileBase.sendMessage(..) above calls samlContext.setOutboundSAMLMessage(message); so the line messageContext.getOutboundMessage() in BaseSAML2MessageEncoder.getEndpointURL(..) would return null. So even for response messages (like saml logout response) the endpoint.getLocation() would be used as destination and not endpoint.getResponseLocation() (this is the one to be used for response messages).

should we not add a line
samlContext.setOutboundMessage(message);

in AbstractProfileBase.sendMessage(..) above ?

[spring-projects-issues]

Vladimir Schäfer said:

Yes Girish, you're right, the outboundMessage should be set in order to be correctly processed inside OpenSAML.
The call was added in revision 79.