Revision: 2064 Author: olavmrk Date: Mon Jan 4 04:43:24 2010 Log: saml2/idp: Log warnings on misbehaving SP logout.
This patch makes the iframe logout code log some warnings if it detects something wrong with the SP logout implementation. http://code.google.com/p/simplesamlphp/source/detail?r=2064 Modified: /trunk/www/saml2/idp/SingleLogoutServiceiFrame.php /trunk/www/saml2/idp/SingleLogoutServiceiFrameResponse.php /trunk/www/saml2/idp/idpInitSingleLogoutServiceiFrame.php ======================================= --- /trunk/www/saml2/idp/SingleLogoutServiceiFrame.php Wed Nov 4 05:53:09 2009 +++ /trunk/www/saml2/idp/SingleLogoutServiceiFrame.php Mon Jan 4 04:43:24 2010 @@ -232,7 +232,26 @@ } catch(Exception $exception) { SimpleSAML_Utilities::fatalError($session->getTrackID(), 'LOGOUTREQUEST', $exception); } - + + /* Log a warning if the NameID in the LogoutRequest isn't the one we assigned to the SP. */ + $requestNameId = $logoutrequest->getNameId(); + ksort($requestNameId); + $sessionNameId = $session->getSessionNameId('saml20-sp-remote', $spEntityId); + ksort($sessionNameId); + if ($sessionNameId !== NULL && $requestNameId !== $sessionNameId) { + SimpleSAML_Logger::warning('Wrong NameID in LogoutRequest from ' . + var_export($spEntityId, TRUE) . '.'); + } + + /* Log a warning if the SessionIndex in the LogoutRequest isn't correct. */ + $requestSessionIndex = $logoutrequest->getSessionIndex(); + $sessionSessionIndex = $session->getSessionIndex(); + if ($requestSessionIndex !== $sessionSessionIndex) { + SimpleSAML_Logger::warning('Wrong SessionIndex in LogoutRequest from ' . + var_export($spEntityId, TRUE) . '.'); + } + + // Extract some parameters from the logout request #$requestid = $logoutrequest->getRequestID(); $requester = $logoutrequest->getIssuer(); @@ -322,6 +341,13 @@ $sparray[$spentityid] = array('url' => $url, 'name' => $name); + /* Add the SP logout request information to the session so that we can check it later. */ + $requestInfo = array( + 'ID' => $lr->getId(), + 'RelayState' => $lr->getRelayState(), + ); + $session->setData('slo-request-info', $spentityid, $requestInfo, 15*60); + } catch (Exception $e) { $sparrayNoLogout[$spentityid] = array('name' => $name); } ======================================= --- /trunk/www/saml2/idp/SingleLogoutServiceiFrameResponse.php Fri Aug 14 04:07:44 2009 +++ /trunk/www/saml2/idp/SingleLogoutServiceiFrameResponse.php Mon Jan 4 04:43:24 2010 @@ -55,6 +55,21 @@ sspmod_saml2_Message::validateMessage($spMetadata, $idpMetadata, $logoutResponse); +/* + * Check the logout response against the logout request, and log + * warnings if there is a mismatch. + */ +$requestInfo = $session->getData('slo-request-info', $spEntityId); +if ($requestInfo !== NULL) { + if ($logoutResponse->getInResponseTo() !== $requestInfo['ID']) { + SimpleSAML_Logger::warning('Wrong InResponseTo in LogoutResponse from ' . + var_export($spEntityId, TRUE) . '.'); + } + if ($logoutResponse->getRelayState() !== $requestInfo['RelayState']) { + SimpleSAML_Logger::warning('Wrong RelayState in LogoutResponse from ' . + var_export($spEntityId, TRUE) . '.'); + } +} $sphash = sha1($spEntityId); setcookie('spstate-' . $sphash , '1'); // Duration: 2 hours ======================================= --- /trunk/www/saml2/idp/idpInitSingleLogoutServiceiFrame.php Wed Nov 4 05:53:09 2009 +++ /trunk/www/saml2/idp/idpInitSingleLogoutServiceiFrame.php Mon Jan 4 04:43:24 2010 @@ -227,7 +227,14 @@ $url = $httpredirect->getRedirectURL($lr); $sparray[$spentityid] = array('url' => $url, 'name' => $name); - + + /* Add the SP logout request information to the session so that we can check it later. */ + $requestInfo = array( + 'ID' => $lr->getId(), + 'RelayState' => $lr->getRelayState(), + ); + $session->setData('slo-request-info', $spentityid, $requestInfo, 15*60); + } catch (Exception $e) { $sparrayNoLogout[$spentityid] = array('name' => $name); -- You received this message because you are subscribed to the Google Groups "simpleSAMLphp commits" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/simplesamlphp-commits?hl=en.
