Author: mposolda Date: 2012-01-20 18:15:57 -0500 (Fri, 20 Jan 2012) New Revision: 8304 Added: components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/SAML2LogoutFilter.java components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/saml/ components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/saml/PortalSAML2LogOutHandler.java Modified: components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/AbstractLogoutFilter.java Log: GTNSSO-4 Support for SAML2 global logout Modified: components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/AbstractLogoutFilter.java =================================================================== --- components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/AbstractLogoutFilter.java 2012-01-18 19:32:20 UTC (rev 8303) +++ components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/AbstractLogoutFilter.java 2012-01-20 23:15:57 UTC (rev 8304) @@ -64,8 +64,10 @@ if (httpRequest.getSession().getAttribute("SSO_LOGOUT_FLAG") == null) { httpRequest.getSession().setAttribute("SSO_LOGOUT_FLAG", Boolean.TRUE); - - httpResponse.sendRedirect(this.getRedirectUrl(httpRequest)); + + String redirectUrl = this.getRedirectUrl(httpRequest); + redirectUrl = httpResponse.encodeRedirectURL(redirectUrl); + httpResponse.sendRedirect(redirectUrl); return; } else Added: components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/SAML2LogoutFilter.java =================================================================== --- components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/SAML2LogoutFilter.java (rev 0) +++ components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/filter/SAML2LogoutFilter.java 2012-01-20 23:15:57 UTC (rev 8304) @@ -0,0 +1,50 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2012, Red Hat Middleware, LLC, and individual + * contributors as indicated by the @authors tag. See the + * copyright.txt in the distribution for a full listing of + * individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ + +package org.gatein.sso.agent.filter; + +import javax.servlet.http.HttpServletRequest; + +/** + * Filter for redirecting GateIn logout request (triggered from GateIn UI by user) to SAML2 global logout request. + * Filter is usable only if we want to enable SAML2 global logout. + * + * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a> + */ +public class SAML2LogoutFilter extends AbstractLogoutFilter +{ + + @Override + protected String getRedirectUrl(HttpServletRequest httpRequest) + { + String logoutURL = this.logoutUrl; + + // URL from filter init parameter has priority, but if not provided, we will use SAML global logout. + if (logoutURL == null) + { + logoutURL = httpRequest.getContextPath() + "/dologin?GLO=true"; + } + + return logoutURL; + } +} Added: components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/saml/PortalSAML2LogOutHandler.java =================================================================== --- components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/saml/PortalSAML2LogOutHandler.java (rev 0) +++ components/sso/trunk/agent/src/main/java/org/gatein/sso/agent/saml/PortalSAML2LogOutHandler.java 2012-01-20 23:15:57 UTC (rev 8304) @@ -0,0 +1,142 @@ +/* + * JBoss, a division of Red Hat + * Copyright 2012, Red Hat Middleware, LLC, and individual + * contributors as indicated by the @authors tag. See the + * copyright.txt in the distribution for a full listing of + * individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ + +package org.gatein.sso.agent.saml; + +import org.apache.catalina.Session; +import org.apache.catalina.connector.Request; +import org.gatein.common.logging.Logger; +import org.gatein.common.logging.LoggerFactory; +import org.gatein.wci.impl.DefaultServletContainerFactory; +import org.picketlink.identity.federation.core.exceptions.ProcessingException; +import org.picketlink.identity.federation.core.saml.v2.interfaces.SAML2HandlerRequest; +import org.picketlink.identity.federation.core.saml.v2.interfaces.SAML2HandlerResponse; +import org.picketlink.identity.federation.saml.v2.protocol.LogoutRequestType; +import org.picketlink.identity.federation.saml.v2.protocol.ResponseType; +import org.picketlink.identity.federation.saml.v2.protocol.StatusResponseType; +import org.picketlink.identity.federation.web.core.HTTPContext; +import org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +/** + * Extension of {@link SAML2LogOutHandler} because we need to enforce WCI (crossContext) logout in portal environment. + * + * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a> + */ +public class PortalSAML2LogOutHandler extends SAML2LogOutHandler +{ + private static Logger log = LoggerFactory.getLogger(PortalSAML2LogOutHandler.class); + + @Override + public void handleRequestType(SAML2HandlerRequest request, SAML2HandlerResponse response) throws ProcessingException + { + if (request.getSAML2Object() instanceof LogoutRequestType == false) + { + return; + } + + HTTPContext httpContext = (HTTPContext) request.getContext(); + HttpServletRequest servletRequest = httpContext.getRequest(); + HttpServletResponse servletResponse = httpContext.getResponse(); + + Session catalinaSession = getCatalinaSession(servletRequest); + + // Handle SAML logout request by superclass + super.handleRequestType(request, response); + + // Check if session has been invalidated by superclass. If yes,we need to perform "full" logout at portal level by call WCI logout. + if (!catalinaSession.isValid()) + { + portalLogout(servletRequest, servletResponse); + } + } + + @Override + public void handleStatusResponseType(SAML2HandlerRequest request, SAML2HandlerResponse response) + throws ProcessingException + { + //We do not handle any ResponseType (authentication etc) + if (request.getSAML2Object() instanceof ResponseType) + return; + + if (request.getSAML2Object() instanceof StatusResponseType == false) + return; + + + HTTPContext httpContext = (HTTPContext) request.getContext(); + HttpServletRequest servletRequest = httpContext.getRequest(); + HttpServletResponse servletResponse = httpContext.getResponse(); + + Session catalinaSession = getCatalinaSession(servletRequest); + + // Handle SAML logout response by superclass + super.handleStatusResponseType(request, response); + + // Check if session has been invalidated by superclass. If yes,we need to perform "full" logout at portal level by call WCI logout. + if (!catalinaSession.isValid()) + { + portalLogout(servletRequest, servletResponse); + } + + } + + /** + * Performs portal logout by calling WCI logout. + * + * @param request + * @param response + */ + protected void portalLogout(HttpServletRequest request, HttpServletResponse response) + { + // Workaround: we need to temporary "restore" session to enforce crossContext logout at WCI layer + request.getSession(true); + + try + { + DefaultServletContainerFactory.getInstance().getServletContainer().logout(request, response); + } + catch (Exception e) + { + String message = "Session has been invalidated but WCI logout failed."; + log.warn(message); + if (log.isTraceEnabled()) + { + log.trace(message, e); + } + } + } + + private Session getCatalinaSession(HttpServletRequest servletRequest) + { + if (!(servletRequest instanceof Request)) + { + throw new IllegalStateException("servletRequest is of class " + servletRequest.getClass() + ", which is not instanceof " + Request.class); + } + + Request catalinaRequest = (Request)servletRequest; + return catalinaRequest.getSessionInternal(false); + } + +}