Revision: 2042 Author: olavmrk Date: Fri Dec 4 03:17:22 2009 Log: saml2/idp: Fix bridged logout.
Merged into 1.5 branch from r2020, r2021 and r2022. http://code.google.com/p/simplesamlphp/source/detail?r=2042 Modified: /branches/simplesamlphp-1.5/www/saml2/idp/SingleLogoutService.php ======================================= --- /branches/simplesamlphp-1.5/www/saml2/idp/SingleLogoutService.php Fri Aug 14 04:07:44 2009 +++ /branches/simplesamlphp-1.5/www/saml2/idp/SingleLogoutService.php Fri Dec 4 03:17:22 2009 @@ -114,8 +114,6 @@ SimpleSAML_Logger::info('SAML2.0 - IdP.SingleLogoutService: got Logoutrequest from ' . $spEntityId); SimpleSAML_Logger::stats('saml20-idp-SLO spinit ' . $spEntityId . ' ' . $idpEntityId); - $session->doLogout(); - /* Fill in the $logoutInfo associative array with information about this logout request. */ $logoutInfo['Issuer'] = $spEntityId; $logoutInfo['RequestID'] = $logoutRequest->getId(); @@ -183,6 +181,32 @@ SimpleSAML_Logger::debug('SAML2.0 - IdP.SingleLogoutService: No request, response or bridge'); SimpleSAML_Utilities::fatalError($session->getTrackID(), 'SLOSERVICEPARAMS'); } + +/* First, log out of the current authentication source. */ +$authority = $session->getAuthority(); +if ($authority !== NULL) { + /* We are logged in. */ + + $bridgedId = SimpleSAML_Utilities::generateID(); + $returnTo = SimpleSAML_Utilities::selfURLNoQuery() . '?LogoutID=' . $bridgedId; + + /* Save the $logoutInfo until we return from the SP. */ + saveLogoutInfo($bridgedId); + + if ($authority === $idpMetadata->getString('auth')) { + /* This is probably an authentication source. */ + SimpleSAML_Auth_Default::initLogoutReturn($returnTo); + } elseif ($authority === 'saml2') { + /* SAML 2 SP which isn't an authentication source. */ + SimpleSAML_Utilities::redirect('/' . $config->getBaseURL() . 'saml2/sp/initSLO.php', + array('RelayState' => $returnTo) + ); + } else { + /* A different old-style authentication file. */ + $session->doLogout(); + } +} + /* * Find the next SP we should log out from. We will search through the list of @@ -255,33 +279,6 @@ -/** - * If there exists a local valid session with the SAML 2.0 module as an authority, - * initiate SAML 2.0 SP Single LogOut, with the RelayState equal this URL. - */ -if ($session->getAuthority() == 'saml2') { - - $bridgedId = SimpleSAML_Utilities::generateID(); - $returnTo = SimpleSAML_Utilities::selfURLNoQuery() . '?LogoutID=' . $bridgedId; - - /* Save the $logoutInfo until we return from the SP. */ - saveLogoutInfo($bridgedId); - - SimpleSAML_Utilities::redirect('/' . $config->getBaseURL() . 'saml2/sp/initSLO.php', - array('RelayState' => $returnTo) - ); -} - -if ($session->getAuthority() == 'shib13') { - /** - * TODO: Show warning to inform the user that he is logged on through an Shibboleth 1.3 IdP that - * do not support logout. - */ -} - - - - /* * Logout procedure is done and we send a Logout Response back to the SP */ -- You received this message because you are subscribed to the Google Groups "simpleSAMLphp commits" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/simplesamlphp-commits?hl=en.
