Repository: cxf-fediz
Updated Branches:
refs/heads/1.2.x-fixes 1bbdb5e7b -> a24a52c29
Adding some tests
Conflicts:
systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/BadWReqTest.java
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/a24a52c2
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/a24a52c2
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/a24a52c2
Branch: refs/heads/1.2.x-fixes
Commit: a24a52c291012d7e62d4cc28ff7ab6c085236648
Parents: 1bbdb5e
Author: Colm O hEigeartaigh <[email protected]>
Authored: Mon Dec 14 16:36:49 2015 +0000
Committer: Colm O hEigeartaigh <[email protected]>
Committed: Mon Dec 14 16:40:42 2015 +0000
----------------------------------------------------------------------
.../integrationtests/AbstractAttackTests.java | 229 +++++++++++++++++++
.../fediz/integrationtests/AbstractTests.java | 96 ++------
.../BadWReqCallbackHandler.java | 48 ----
.../test/resources/fediz_config_bad_wreq.xml | 57 -----
4 files changed, 249 insertions(+), 181 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/a24a52c2/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractAttackTests.java
----------------------------------------------------------------------
diff --git
a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractAttackTests.java
b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractAttackTests.java
new file mode 100644
index 0000000..69e3f50
--- /dev/null
+++
b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractAttackTests.java
@@ -0,0 +1,229 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.integrationtests;
+
+import java.net.URLEncoder;
+
+import org.apache.http.auth.AuthScope;
+import org.apache.http.auth.UsernamePasswordCredentials;
+import org.apache.wss4j.dom.WSSConfig;
+import org.junit.Assert;
+import org.junit.Test;
+
+import com.gargoylesoftware.htmlunit.CookieManager;
+import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
+import com.gargoylesoftware.htmlunit.WebClient;
+import com.gargoylesoftware.htmlunit.html.DomElement;
+import com.gargoylesoftware.htmlunit.html.DomNodeList;
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+
+/**
+ * Some negative/attack tests for the IdP/RP
+ */
+public abstract class AbstractAttackTests {
+
+ static final String TEST_WREQ =
+ "<RequestSecurityToken
xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\";>"
+ +
"<TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV3.0</TokenType>"
+ + "</RequestSecurityToken>";
+
+ static {
+ WSSConfig.init();
+ }
+
+ public AbstractAttackTests() {
+ super();
+ }
+
+ public abstract String getServletContextName();
+
+ public abstract String getIdpHttpsPort();
+
+ public abstract String getRpHttpsPort();
+
+ @Test
+ public void testAliceModifiedSignature() throws Exception {
+ String url = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName()
+ + "/secure/fedservlet";
+ String user = "alice";
+ String password = "ecila";
+
+ // Get the initial token
+ CookieManager cookieManager = new CookieManager();
+ final WebClient webClient = new WebClient();
+ webClient.setCookieManager(cookieManager);
+ webClient.getOptions().setUseInsecureSSL(true);
+ webClient.getCredentialsProvider().setCredentials(
+ new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
+ new UsernamePasswordCredentials(user, password));
+
+ webClient.getOptions().setJavaScriptEnabled(false);
+ final HtmlPage idpPage = webClient.getPage(url);
+ webClient.getOptions().setJavaScriptEnabled(true);
+ Assert.assertEquals("IDP SignIn Response Form",
idpPage.getTitleText());
+
+ // Parse the form to get the token (wresult)
+ DomNodeList<DomElement> results =
idpPage.getElementsByTagName("input");
+
+ for (DomElement result : results) {
+ if ("wresult".equals(result.getAttributeNS(null, "name"))) {
+ // Now modify the Signature
+ String value = result.getAttributeNS(null, "value");
+ value = value.replace("alice", "bob");
+ result.setAttributeNS(null, "value", value);
+ }
+ }
+
+ // Invoke back on the RP
+
+ final HtmlForm form = idpPage.getFormByName("signinresponseform");
+ final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
+
+ try {
+ button.click();
+ Assert.fail("Failure expected on a modified signature");
+ } catch (FailingHttpStatusCodeException ex) {
+ // expected
+ Assert.assertTrue(ex.getMessage().contains("401 Unauthorized")
+ || ex.getMessage().contains("401 Authentication
Failed")
+ || ex.getMessage().contains("403 Forbidden"));
+ }
+ }
+
+ @Test
+ public void testConcurrentRequests() throws Exception {
+
+ String url1 = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName() + "/secure/fedservlet";
+ String url2 = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName() + "/secure/test.html";
+ String user = "bob";
+ String password = "bob";
+
+ // Get the initial token
+ CookieManager cookieManager = new CookieManager();
+ final WebClient webClient = new WebClient();
+ webClient.setCookieManager(cookieManager);
+ webClient.getOptions().setUseInsecureSSL(true);
+ webClient.getCredentialsProvider().setCredentials(
+ new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
+ new UsernamePasswordCredentials(user, password));
+
+ webClient.getOptions().setJavaScriptEnabled(false);
+ final HtmlPage idpPage1 = webClient.getPage(url1);
+ final HtmlPage idpPage2 = webClient.getPage(url2);
+ webClient.getOptions().setJavaScriptEnabled(true);
+ Assert.assertEquals("IDP SignIn Response Form",
idpPage1.getTitleText());
+ Assert.assertEquals("IDP SignIn Response Form",
idpPage2.getTitleText());
+
+ // Invoke back on the page1 RP
+ final HtmlForm form = idpPage1.getFormByName("signinresponseform");
+ final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
+ final HtmlPage rpPage1 = button.click();
+ Assert.assertTrue("WS Federation Systests
Examples".equals(rpPage1.getTitleText())
+ || "WS Federation Systests Spring
Examples".equals(rpPage1.getTitleText()));
+
+ String bodyTextContent1 = rpPage1.getBody().getTextContent();
+
+ Assert.assertTrue("Principal not " + user,
+ bodyTextContent1.contains("userPrincipal=" + user));
+
+ // Invoke back on the page2 RP
+ final HtmlForm form2 = idpPage2.getFormByName("signinresponseform");
+ final HtmlSubmitInput button2 =
form2.getInputByName("_eventId_submit");
+ final HtmlPage rpPage2 = button2.click();
+ String bodyTextContent2 = rpPage2.getBody().getTextContent();
+
+ Assert.assertTrue("Unexpected content of RP page",
bodyTextContent2.contains("Secure Test"));
+ }
+
+ @org.junit.Test
+ public void testMaliciousRedirect() throws Exception {
+ String url = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName() + "/secure/fedservlet";
+ String user = "alice";
+ String password = "ecila";
+
+ CookieManager cookieManager = new CookieManager();
+
+ // 1. Login
+ HTTPTestUtils.loginWithCookieManager(url, user, password,
getIdpHttpsPort(), cookieManager);
+
+ // 2. Now we should have a cookie from the RP and IdP and should be
able to do
+ // subsequent requests without authenticate again. Lets test this
first.
+ WebClient webClient = new WebClient();
+ webClient.setCookieManager(cookieManager);
+ webClient.getOptions().setUseInsecureSSL(true);
+ HtmlPage rpPage = webClient.getPage(url);
+ Assert.assertTrue("WS Federation Systests
Examples".equals(rpPage.getTitleText())
+ || "WS Federation Systests Spring
Examples".equals(rpPage.getTitleText()));
+
+ // 3. Now a malicious user sends the client a URL with a bad "wreply"
address to the IdP
+ String maliciousURL = "https://www.apache.org/attack";;
+ String idpUrl
+ = "https://localhost:"; + getIdpHttpsPort() + "/fediz-idp/federation";
+ idpUrl += "?wa=wsignin1.0&wreply=" + URLEncoder.encode(maliciousURL,
"UTF-8");
+ idpUrl +=
"&wtrealm=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Afedizhelloworld";
+ idpUrl += "&whr=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Aidp%3Arealm-A";
+
+ final WebClient webClient2 = new WebClient();
+ webClient2.setCookieManager(cookieManager);
+ webClient2.getOptions().setUseInsecureSSL(true);
+ webClient2.getCredentialsProvider().setCredentials(
+ new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
+ new UsernamePasswordCredentials(user, password));
+
+ webClient2.getOptions().setJavaScriptEnabled(false);
+ try {
+ webClient2.getPage(idpUrl);
+ Assert.fail("Failure expected on a bad wreply address");
+ } catch (FailingHttpStatusCodeException ex) {
+ Assert.assertEquals(ex.getStatusCode(), 400);
+ }
+ }
+
+ // Send an unknown wreq value
+ @org.junit.Test
+ public void testBadWReq() throws Exception {
+ String url = "https://localhost:"; + getIdpHttpsPort() +
"/fediz-idp/federation?";
+ url += "wa=wsignin1.0";
+ url += "&whr=urn:org:apache:cxf:fediz:idp:realm-A";
+ url += "&wtrealm=urn:org:apache:cxf:fediz:fedizhelloworld";
+ String wreply = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName() + "/secure/fedservlet";
+ url += "&wreply=" + wreply;
+ url += "&wreq=" + URLEncoder.encode(TEST_WREQ, "UTF-8");
+
+ String user = "alice";
+ String password = "ecila";
+
+ final WebClient webClient = new WebClient();
+ webClient.getOptions().setUseInsecureSSL(true);
+ webClient.getCredentialsProvider().setCredentials(
+ new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
+ new UsernamePasswordCredentials(user, password));
+
+ webClient.getOptions().setJavaScriptEnabled(false);
+ try {
+ webClient.getPage(url);
+ Assert.fail("Failure expected on a bad wreq value");
+ } catch (FailingHttpStatusCodeException ex) {
+ Assert.assertEquals(ex.getStatusCode(), 400);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/a24a52c2/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
----------------------------------------------------------------------
diff --git
a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
index a9d6312..6db8618 100644
---
a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
+++
b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
@@ -28,9 +28,7 @@ import
com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
import com.gargoylesoftware.htmlunit.WebClient;
import com.gargoylesoftware.htmlunit.html.DomElement;
import com.gargoylesoftware.htmlunit.html.DomNodeList;
-import com.gargoylesoftware.htmlunit.html.HtmlForm;
import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
import com.gargoylesoftware.htmlunit.xml.XmlPage;
import org.apache.cxf.fediz.core.ClaimTypes;
@@ -44,7 +42,12 @@ import org.apache.xml.security.signature.XMLSignature;
import org.junit.Assert;
import org.junit.Test;
-public abstract class AbstractTests {
+public abstract class AbstractTests extends AbstractAttackTests {
+
+ static final String TEST_WREQ =
+ "<RequestSecurityToken
xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\";>"
+ +
"<TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV3.0</TokenType>"
+ + "</RequestSecurityToken>";
static {
WSSConfig.init();
@@ -540,17 +543,19 @@ public abstract class AbstractTests {
Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode());
}
- @Test
- public void testAliceModifiedSignature() throws Exception {
- String url = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName()
- + "/secure/fedservlet";
+ @org.junit.Test
+ public void testSuccessfulInvokeOnIdP() throws Exception {
+ String url = "https://localhost:"; + getIdpHttpsPort() +
"/fediz-idp/federation?";
+ url += "wa=wsignin1.0";
+ url += "&whr=urn:org:apache:cxf:fediz:idp:realm-A";
+ url += "&wtrealm=urn:org:apache:cxf:fediz:fedizhelloworld";
+ String wreply = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName() + "/secure/fedservlet";
+ url += "&wreply=" + wreply;
+
String user = "alice";
String password = "ecila";
- // Get the initial token
- CookieManager cookieManager = new CookieManager();
final WebClient webClient = new WebClient();
- webClient.setCookieManager(cookieManager);
webClient.getOptions().setUseInsecureSSL(true);
webClient.getCredentialsProvider().setCredentials(
new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
@@ -560,79 +565,18 @@ public abstract class AbstractTests {
final HtmlPage idpPage = webClient.getPage(url);
webClient.getOptions().setJavaScriptEnabled(true);
Assert.assertEquals("IDP SignIn Response Form",
idpPage.getTitleText());
-
+
// Parse the form to get the token (wresult)
DomNodeList<DomElement> results =
idpPage.getElementsByTagName("input");
+ String wresult = null;
for (DomElement result : results) {
if ("wresult".equals(result.getAttributeNS(null, "name"))) {
- // Now modify the Signature
- String value = result.getAttributeNS(null, "value");
- value = value.replace("alice", "bob");
- result.setAttributeNS(null, "value", value);
+ wresult = result.getAttributeNS(null, "value");
+ break;
}
}
- // Invoke back on the RP
-
- final HtmlForm form = idpPage.getFormByName("signinresponseform");
- final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
- try {
- button.click();
- Assert.fail("Failure expected on a modified signature");
- } catch (FailingHttpStatusCodeException ex) {
- // expected
- Assert.assertTrue(ex.getMessage().contains("401 Unauthorized")
- || ex.getMessage().contains("401 Authentication
Failed")
- || ex.getMessage().contains("403 Forbidden"));
- }
-
- }
-
- @Test
- public void testConcurrentRequests() throws Exception {
-
- String url1 = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName() + "/secure/fedservlet";
- String url2 = "https://localhost:"; + getRpHttpsPort() + "/" +
getServletContextName() + "/secure/test.html";
- String user = "bob";
- String password = "bob";
-
- // Get the initial token
- CookieManager cookieManager = new CookieManager();
- final WebClient webClient = new WebClient();
- webClient.setCookieManager(cookieManager);
- webClient.getOptions().setUseInsecureSSL(true);
- webClient.getCredentialsProvider().setCredentials(
- new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
- new UsernamePasswordCredentials(user, password));
-
- webClient.getOptions().setJavaScriptEnabled(false);
- final HtmlPage idpPage1 = webClient.getPage(url1);
- final HtmlPage idpPage2 = webClient.getPage(url2);
- webClient.getOptions().setJavaScriptEnabled(true);
- Assert.assertEquals("IDP SignIn Response Form",
idpPage1.getTitleText());
- Assert.assertEquals("IDP SignIn Response Form",
idpPage2.getTitleText());
-
- // Invoke back on the page1 RP
- final HtmlForm form = idpPage1.getFormByName("signinresponseform");
- final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
- final HtmlPage rpPage1 = button.click();
- Assert.assertTrue("WS Federation Systests
Examples".equals(rpPage1.getTitleText())
- || "WS Federation Systests Spring
Examples".equals(rpPage1.getTitleText()));
-
- String bodyTextContent1 = rpPage1.getBody().getTextContent();
-
- Assert.assertTrue("Principal not " + user,
- bodyTextContent1.contains("userPrincipal=" + user));
-
- // Invoke back on the page2 RP
- final HtmlForm form2 = idpPage2.getFormByName("signinresponseform");
- final HtmlSubmitInput button2 =
form2.getInputByName("_eventId_submit");
- final HtmlPage rpPage2 = button2.click();
- String bodyTextContent2 = rpPage2.getBody().getTextContent();
-
- Assert.assertTrue("Unexpected content of RP page",
bodyTextContent2.contains("Secure Test"));
-
+ Assert.assertNotNull(wresult);
}
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/a24a52c2/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/BadWReqCallbackHandler.java
----------------------------------------------------------------------
diff --git
a/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/BadWReqCallbackHandler.java
b/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/BadWReqCallbackHandler.java
deleted file mode 100644
index a35d286..0000000
---
a/systests/tomcat7/src/test/java/org/apache/cxf/fediz/integrationtests/BadWReqCallbackHandler.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.integrationtests;
-
-import java.io.IOException;
-
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
-
-import org.apache.cxf.fediz.core.spi.WReqCallback;
-
-public class BadWReqCallbackHandler implements CallbackHandler {
-
- static final String TEST_WREQ =
- "<RequestSecurityToken
xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\";>"
- +
"<TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV3.0</TokenType>"
- + "</RequestSecurityToken>";
-
- public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
- for (int i = 0; i < callbacks.length; i++) {
- if (callbacks[i] instanceof WReqCallback) {
- WReqCallback callback = (WReqCallback) callbacks[i];
- callback.setWreq(TEST_WREQ);
- } else {
- throw new UnsupportedCallbackException(callbacks[i],
"Unrecognized Callback");
- }
- }
- }
-
-}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/a24a52c2/systests/tomcat7/src/test/resources/fediz_config_bad_wreq.xml
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/resources/fediz_config_bad_wreq.xml
b/systests/tomcat7/src/test/resources/fediz_config_bad_wreq.xml
deleted file mode 100644
index 91432e0..0000000
--- a/systests/tomcat7/src/test/resources/fediz_config_bad_wreq.xml
+++ /dev/null
@@ -1,57 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
--->
-<!-- Place in Tomcat conf folder or other location as designated in this
sample's webapp/META-INF/context.xml file.
- Keystore referenced below must have IDP STS' public cert included in it.
This example re-uses the Tomcat SSL
- keystore (tomcat-rp.jks) for this task; alternatively you may wish to use
a Fediz-specific keystore instead.
--->
-<FedizConfig>
- <contextConfig name="/fedizhelloworld">
- <audienceUris>
-
<audienceItem>urn:org:apache:cxf:fediz:fedizhelloworld</audienceItem>
- </audienceUris>
- <certificateStores>
- <trustManager>
- <keyStore file="test-classes/clienttrust.jks"
- password="storepass" type="JKS" />
- </trustManager>
- </certificateStores>
- <trustedIssuers>
- <issuer certificateValidation="PeerTrust" />
- </trustedIssuers>
- <maximumClockSkew>1000</maximumClockSkew>
- <protocol xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
- xsi:type="federationProtocolType" version="1.0.0">
- <realm>urn:org:apache:cxf:fediz:fedizhelloworld</realm>
-
<issuer>https://localhost:${idp.https.port}/fediz-idp/federation</issuer>
- <roleDelimiter>,</roleDelimiter>
-
<roleURI>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role</roleURI>
- <freshness>10</freshness>
- <homeRealm
type="String">urn:org:apache:cxf:fediz:idp:realm-A</homeRealm>
- <claimTypesRequested>
- <claimType type="a particular claim type"
- optional="true" />
- </claimTypesRequested>
- <request
type="Class">org.apache.cxf.fediz.integrationtests.BadWReqCallbackHandler</request>
- </protocol>
- <logoutURL>/secure/logout</logoutURL>
- <logoutRedirectTo>/index.html</logoutRedirectTo>
- </contextConfig>
-</FedizConfig>
-
