Revision: 2181
Author: hans.zandbelt
Date: Mon Feb 15 11:18:18 2010
Log: add support in core IDP for association groups which are used to share
associations between SAML 2 and ADFS IDPs, to enable cross-protocol
single-logout (thanks Olav)
http://code.google.com/p/simplesamlphp/source/detail?r=2181
Modified:
/trunk/lib/SimpleSAML/IdP.php
=======================================
--- /trunk/lib/SimpleSAML/IdP.php Sun Feb 14 11:38:59 2010
+++ /trunk/lib/SimpleSAML/IdP.php Mon Feb 15 11:18:18 2010
@@ -26,6 +26,17 @@
private $id;
+ /**
+ * The "association group" for this IdP.
+ *
+ * We use this to support cross-protocol logout until
+ * we implement a cross-protocol IdP.
+ *
+ * @var string
+ */
+ private $associationGroup;
+
+
/**
* The configuration for this IdP.
*
@@ -62,9 +73,22 @@
throw new SimpleSAML_Error_Exception('enable.adfs-idp disabled in
config.php.');
}
$this->config = $metadata->getMetaDataConfig(substr($id,
5), 'adfs-idp-hosted');
+
+ try {
+ /* This makes the ADFS IdP use the same SP associations as the SAML
2.0 IdP. */
+ $saml2EntityId =
$metadata->getMetaDataCurrentEntityID('saml20-idp-hosted');
+ $this->associationGroup = 'saml2:' .
$saml2EntityId;
+
+ } catch (Exception $e) {
+ /* Probably no SAML 2 IdP configured for this host. Ignore the error.
*/
+ }
} else {
assert(FALSE);
}
+
+ if ($this->associationGroup === NULL) {
+ $this->associationGroup = $this->id;
+ }
}
@@ -157,7 +181,7 @@
assert('isset($association["Handler"])');
$session = SimpleSAML_Session::getInstance();
- $session->addAssociation($this->id, $association);
+ $session->addAssociation($this->associationGroup, $association);
}
@@ -169,7 +193,7 @@
public function getAssociations() {
$session = SimpleSAML_Session::getInstance();
- return $session->getAssociations($this->id);
+ return $session->getAssociations($this->associationGroup);
}
@@ -182,7 +206,7 @@
assert('is_string($assocId)');
$session = SimpleSAML_Session::getInstance();
- $session->terminateAssociation($this->id, $assocId);
+ $session->terminateAssociation($this->associationGroup,
$assocId);
}
--
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en.
