280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<%--

59602f2a7c4e4809941583bed3e94cd26e628f1aTinderbox User DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.

6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User Copyright (c) 2008 Sun Microsystems Inc. All Rights Reserved

19558a04decde0e7261d489d92d04ad88104217bTinderbox User

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews The contents of this file are subject to the terms

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews of the Common Development and Distribution License

c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox User (the License). You may not use this file except in

03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User compliance with the License.

f4ee48be3994797a8332b86c101db4d7b54799ceTinderbox User

a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User You can obtain a copy of the License at

8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User https://opensso.dev.java.net/public/CDDLv1.0.html or

e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User opensso/legal/CDDLv1.0.txt

950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User See the License for the specific language governing

b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User permission and limitations under the License.

03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User

3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont When distributing Covered Code, include this CDDL

e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews Header Notice in each file and include the License file

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews at opensso/legal/CDDLv1.0.txt.

b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews If applicable, add the following below the CDDL Header,

d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User with the fields enclosed by brackets [] replaced by

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews your own identifying information:

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews "Portions Copyrighted [year] [name of copyright owner]"

3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont

d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User $Id: spSingleLogoutPOST.jsp,v 1.8 2009/06/24 23:05:31 mrudulahg Exp $

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User--%>

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<%@ page import="com.sun.identity.shared.debug.Debug" %>

efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews<%@ page import="com.sun.identity.sae.api.SecureAttrs" %>

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<%@ page import="com.sun.identity.saml.common.SAMLUtils" %>

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<%@ page import="com.sun.identity.saml2.common.SAML2Utils" %>

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<%@ page import="com.sun.identity.saml2.common.SAML2Constants" %>

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<%@ page import="com.sun.identity.saml2.common.SAML2Exception" %>

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<%@ page import="com.sun.identity.saml2.jaxb.entityconfig.SPSSOConfigElement" %>

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<%@ page import="com.sun.identity.saml2.meta.SAML2MetaUtils" %>

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<%@ page import="com.sun.identity.saml2.meta.SAML2MetaManager" %>

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<%@ page import="com.sun.identity.saml2.profile.CacheObject" %>

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<%@ page import="com.sun.identity.saml2.profile.SPCache" %>

015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<%@ page import="com.sun.identity.saml2.profile.SPSingleLogout" %>

03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<%@ page import="com.sun.identity.saml2.profile.IDPCache" %>

aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<%@ page import="com.sun.identity.saml2.profile.IDPSingleLogout" %>

dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<%@ page import="com.sun.identity.saml2.protocol.LogoutRequest" %>

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<%@ page import="com.sun.identity.saml2.assertion.Issuer" %>

aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<%@ page import="com.sun.identity.saml2.profile.IDPProxyUtil" %>

9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<%@ page import="com.sun.identity.saml2.protocol.ProtocolFactory" %>

3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<%@ page import="java.util.HashMap" %>

9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<%@ page import="java.util.Map" %>

aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<%@ page import="java.util.Properties" %>

dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<%--

aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt spSingleLogoutPOST.jsp

710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User

9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater - receives the LogoutRequest and sends the LogoutResponse to

3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont Identity Provider from the Service Provider.

9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater OR

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews - receives the LogoutResponse from the Identity Provider.

cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Required parameters to this jsp are :

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt - RelayState - the target URL on successful Single Logout

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews - SAMLRequest - the LogoutRequest

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews OR

9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater - SAMLResponse - the LogoutResponse

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Check the SAML2 Documentation for supported parameters.

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt--%>

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews

9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<%

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews // Retrieves the LogoutRequest or LogoutResponse

eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews //Retrieves :

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews //- RelayState - the target URL on successful Single Logout

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews //- SAMLRequest - the LogoutRequest

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt //OR

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews //- SAMLResponse - the LogoutResponse

015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User

03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User String relayState = request.getParameter(SAML2Constants.RELAY_STATE);

fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews if (relayState != null) {

b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews CacheObject tmpRs=

b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews (CacheObject) SPCache.relayStateHash.remove(relayState);

fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews if ((tmpRs != null)) {

2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt relayState = (String) tmpRs.getObject();

2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt }

2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt }

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt String samlResponse = request.getParameter(SAML2Constants.SAML_RESPONSE);

2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt if (samlResponse != null) {

7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox User try {

03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User /**

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews * Gets and processes the Single <code>LogoutResponse</code> from IDP,

549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User * destroys the local session, checks response's issuer

549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User * and inResponseTo.

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews *

549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User * @param request the HttpServletRequest.

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews * @param response the HttpServletResponse.

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User * @param samlResponse <code>LogoutResponse</code> in the

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews * XML string format.

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews * @param relayState the target URL on successful

b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews * <code>LogoutResponse</code>.

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews * @throws SAML2Exception if error processing

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User * <code>LogoutResponse</code>.

aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User */

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Map infoMap =

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User SPSingleLogout.processLogoutResponse(request,response,

91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson samlResponse, relayState);

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User String inRes = (String) infoMap.get("inResponseTo");

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews LogoutRequest origLogoutRequest = (LogoutRequest)

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt IDPCache.proxySPLogoutReqCache.get(inRes);

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews if (origLogoutRequest != null && !origLogoutRequest.equals("")) {

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User IDPCache.proxySPLogoutReqCache.remove(inRes);

efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews IDPProxyUtil.sendProxyLogoutResponse(response,

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews origLogoutRequest.getID(), infoMap,

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt origLogoutRequest.getIssuer().getValue(),

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews SAML2Constants.HTTP_POST);

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User return;

91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson }

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User } catch (SAML2Exception sse) {

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews SAML2Utils.debug.error("Error processing LogoutResponse :", sse);

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt SAMLUtils.sendError(request, response, response.SC_BAD_REQUEST,

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews "LogoutResponseProcessingError",

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User SAML2Utils.bundle.getString("LogoutResponseProcessingError") +

91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson " " + sse.getMessage());

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User return;

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews } catch (Exception e) {

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt SAML2Utils.debug.error("Error processing LogoutResponse ",e);

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews SAMLUtils.sendError(request, response, response.SC_BAD_REQUEST,

28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews "LogoutResponseProcessingError",

03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User SAML2Utils.bundle.getString("LogoutResponseProcessingError") +

78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews " " + e.getMessage());

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User return;

a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews }

78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews

fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews if (relayState != null && relayState.length() != 0) {

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User try {

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews response.sendRedirect(relayState);

fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews } catch (java.io.IOException ioe) {

2a31bd531072824ef252c18303859d6af7451b00Francis Dupont if (SAML2Utils.debug.messageEnabled()) {

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User SAML2Utils.debug.message(

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews "Exception when redirecting to " +

2a31bd531072824ef252c18303859d6af7451b00Francis Dupont relayState, ioe);

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews }

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User }

5747235bf35e7398984fd6b4632743396895ea7aTinderbox User } else {

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews %>

78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews <jsp:forward page="/saml2/jsp/default.jsp?message=spSloSuccess" />

a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <%

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews }

78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews } else {

78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews String samlRequest = request.getParameter(SAML2Constants.SAML_REQUEST);

7f9e2fff07b9c17e0d7a0ea7abc9304ce9d01b61Tinderbox User if (samlRequest != null) {

5747235bf35e7398984fd6b4632743396895ea7aTinderbox User // Logout SP app via SAE first. App is obligated to redirect back

78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews // to complete this SLO request.

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews if (!SPCache.isFedlet) {

549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User if (processSAELogout(request, response)) {

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews return;

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews }

fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews }

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User

827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews try {

01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews /**

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User * Gets and processes the Single <code>LogoutRequest</code> from

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User * IDP.

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User *

cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater * @param request the HttpServletRequest.

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews * @param response the HttpServletResponse.

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt * @param samlRequest <code>LogoutRequest</code> in the

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews * XML string format.

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User * @param relayState the target URL on successful

fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater * <code>LogoutRequest</code>.

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User * @throws SAML2Exception if error processing

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews * <code>LogoutRequest</code>.

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt */

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews SPSingleLogout.processLogoutRequest(request,response,

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User samlRequest,relayState);

fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User } catch (SAML2Exception sse) {

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User SAML2Utils.debug.error("Error processing LogoutRequest :", sse);

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews SAMLUtils.sendError(request, response, response.SC_BAD_REQUEST,

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt "LogoutRequestProcessingError",

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews SAML2Utils.bundle.getString("LogoutRequestProcessingError")

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User + " " + sse.getMessage());

fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater return;

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User } catch (Exception e) {

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews SAML2Utils.debug.error("Error processing LogoutRequest ",e);

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt SAMLUtils.sendError(request, response, response.SC_BAD_REQUEST,

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews "LogoutRequestProcessingError",

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User SAML2Utils.bundle.getString("LogoutRequestProcessingError")

91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson + " " + e.getMessage());

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User return;

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews }

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt }

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews }

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User%>

dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater<%!

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox Userboolean processSAELogout(

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews HttpServletRequest request, HttpServletResponse response)

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt{

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews String saeData = request.getParameter(SecureAttrs.SAE_PARAM_APPRETURN);

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User if (saeData != null) { // App returned back.

133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater return false;

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User }

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt try {

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews String metaAlias =

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User SAML2MetaUtils.getMetaAliasByUri(request.getRequestURI()) ;

91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson String realm = SAML2MetaUtils.getRealmByMetaAlias(metaAlias);

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User SAML2MetaManager mm = SAML2Utils.getSAML2MetaManager();

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews String entityId = mm.getEntityByMetaAlias(metaAlias);

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt SPSSOConfigElement spConfig = mm.getSPSSOConfig(realm, entityId);

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews String appSLOUrlStr = null;

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User if (spConfig != null) {

5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User appSLOUrlStr = SAML2Utils.getAttributeValueFromSPSSOConfig(

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User spConfig, SAML2Constants.SAE_SP_LOGOUT_URL);

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews }

30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt if (appSLOUrlStr == null) {

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews SAML2Utils.debug.message(

015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User "spSLOPOST:SAE:appSLOUrl not configured.");

ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews return false;

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User }

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User

e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews if (SAML2Utils.debug.messageEnabled()) {

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User SAML2Utils.debug.message(

bac4435d473c9a0281507524f084480c34aa942aTinderbox User "spSLOPOST:SAE:processing App SLO"+ appSLOUrlStr);

1fce11b1d3f2d461d261156b8cdc64ab864f06a9Tinderbox User }

fab54780409846f7c71f6026d665f18c77c649efTinderbox User StringBuffer appSLOUrl = new StringBuffer(appSLOUrlStr);

a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews Map hp = SAML2Utils.getSAEAttrs(

7ca715ad1587a68a531ea1cdea07515d7232567eTinderbox User realm, entityId, SAML2Constants.SP_ROLE, appSLOUrlStr);

015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User if (hp == null) {

8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater SAML2Utils.debug.error(

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater "spSLOPOST:SAE:processing App SLO: getSAEAttrs returned null");

bac4435d473c9a0281507524f084480c34aa942aTinderbox User return false;

91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews }

933799f3641f4f78445d015008bad0038900a82aTinderbox User String cryptoType = (String) hp.get(SecureAttrs.SAE_CRYPTO_TYPE);

8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews String secret = null;

933799f3641f4f78445d015008bad0038900a82aTinderbox User String encSecret = null;

4151211e6649332f7b5a55870cbe37128bcc7b29Tinderbox User String encAlg = (String)hp.get(

91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews SecureAttrs.SAE_CONFIG_DATA_ENCRYPTION_ALG);

ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews String encStrength = (String)hp.get(

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater SecureAttrs.SAE_CONFIG_ENCRYPTION_KEY_STRENGTH);

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if (SecureAttrs.SAE_CRYPTO_TYPE_SYM.equals(cryptoType)) {

f525041ae26958385b697cf82a30f108577024b6Tinderbox User // Shared secret between FM-IDP and IDPApp

b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User secret = (String) hp.get(SecureAttrs.SAE_CONFIG_SHARED_SECRET );

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater encSecret = secret;

ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User } else {

59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater // IDPApp's public key

3ec8f7777ea2b04fc1ebb63077f0916f63b1011aTinderbox User secret = (String) hp.get(SecureAttrs.SAE_CONFIG_PRIVATE_KEY_ALIAS);

c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User encSecret =

b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User (String) hp.get(SecureAttrs.SAE_CONFIG_PUBLIC_KEY_ALIAS);

933799f3641f4f78445d015008bad0038900a82aTinderbox User }

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if (secret == null || secret.length() == 0) {

19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater SAML2Utils.debug.error(

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater "spSLOPOST:SAE:processing App SLO:getSAEAttrs no secret/key");

9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater return false;

ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews }

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if (encAlg == null) {

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater encSecret = null;

bac4435d473c9a0281507524f084480c34aa942aTinderbox User }

39ae0eafed076ef769fef5c18b22a8051df5c93aTinderbox User

91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews String returnURL = request.getRequestURL()+

c2abd6efeb9affa70aabb63da2acb23e135cf7f2Mark Andrews "?"+request.getQueryString()+"&"+

3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont SecureAttrs.SAE_PARAM_APPRETURN+"=true";

dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User HashMap map = new HashMap();

f525041ae26958385b697cf82a30f108577024b6Tinderbox User map.put(SecureAttrs.SAE_PARAM_CMD, SecureAttrs.SAE_CMD_LOGOUT);

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater map.put(SecureAttrs.SAE_PARAM_APPSLORETURNURL, returnURL);

9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater String saInstanceName = cryptoType + "_" + encAlg + "_" + encStrength;

dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User SecureAttrs sa = SecureAttrs.getInstance(saInstanceName);

5e82fe9a56d17bfbd120817d00d28c5952ab4ddcTinderbox User if (sa == null) {

4cda4fd158d6ded5586bacea8c388445d99611eaAutomatic Updater Properties prop = new Properties();

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews prop.setProperty(SecureAttrs.SAE_CONFIG_CERT_CLASS,

f2f7a53ba0ba69cfe8c505eea16f71bad9d8d449Tinderbox User "com.sun.identity.sae.api.FMCerts");

c26604a73c4ce907ef6392f38b3fac838b1873a9Tinderbox User if (encAlg != null) {

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews prop.setProperty(

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater SecureAttrs.SAE_CONFIG_DATA_ENCRYPTION_ALG, encAlg);

a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User }

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews if (encStrength != null) {

7d638dd31ecb633aaefca994b60b70c58b5def03Tinderbox User prop.setProperty(

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews SecureAttrs.SAE_CONFIG_ENCRYPTION_KEY_STRENGTH,encStrength); }

ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User SecureAttrs.init(saInstanceName, cryptoType, prop);

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews sa = SecureAttrs.getInstance(saInstanceName);

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater }

76408aae412cda298c5e43da0eebb23c875a4426Tinderbox User

7f9e2fff07b9c17e0d7a0ea7abc9304ce9d01b61Tinderbox User if (sa == null) {

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater SAML2Utils.debug.error(

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User "spSLOPOST:SAE:processing App SLO:null SecureAttrs instance");

dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews return false;

da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User }

710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User String encodedString = sa.getEncodedString(map, secret, encSecret);

757ff043760e4743dda1a10e7d58349275934902Tinderbox User if (encodedString != null) {

a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User if (appSLOUrl.indexOf("?") > 0) {

a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User appSLOUrl.append("&").append(SecureAttrs.SAE_PARAM_DATA)

a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews .append("=").append(encodedString);

757ff043760e4743dda1a10e7d58349275934902Tinderbox User } else {

ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater appSLOUrl.append("?").append(SecureAttrs.SAE_PARAM_DATA)

a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User .append("=").append(encodedString);

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User }

91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson if (SAML2Utils.debug.messageEnabled()) {

a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User SAML2Utils.debug.message("spSLOPOST:SAE:about to redirect"+

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User appSLOUrl);

5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User }

0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews response.sendRedirect(appSLOUrl.toString());

ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User return true;

a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User } else {

f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews SAML2Utils.debug.error(

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User "spSLOPOST:SAE:SecureAttrs.getEncodedStr failed");

b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User }

03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User } catch (Exception ex) {

3857cb6fcabeb79d85de4b3e3e4ab99912b701f8Mark Andrews SAML2Utils.debug.error("spSLOPOST:SAE:SecureAttrs.Fatal:",ex);

e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User }

e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User return false;

c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews}

9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User%>

91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson