Author: anil.saldhana(a)jboss.com Date: 2009-10-13 19:06:42 -0400 (Tue, 13 Oct 2009) New Revision: 857 Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/TomcatAttributeManager.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java Log: JBID:40: saml logout Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/TomcatAttributeManager.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/TomcatAttributeManager.java 2009-10-13 23:05:03 UTC (rev 856) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/TomcatAttributeManager.java 2009-10-13 23:06:42 UTC (rev 857) @@ -22,6 +22,7 @@ package org.jboss.identity.federation.bindings.tomcat; import java.security.Principal; +import java.util.HashMap; import java.util.List; import java.util.Map; @@ -41,6 +42,6 @@ public Map<String, Object> getAttributes(Principal userPrincipal, List<String> attributeKeys) { - throw new RuntimeException("Not Implemented"); + return new HashMap<String, Object>(); } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-13 23:05:03 UTC (rev 856) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-13 23:06:42 UTC (rev 857) @@ -38,10 +38,13 @@ String GLOBAL_LOGOUT = "GLO"; + String IDENTITY_SERVER = "IDENTITY_SERVER"; String IGNORE_SIGNATURES = "IGNORE_SIGNATURES"; String KEYPAIR = "KEYPAIR"; + String LOGOUT_PAGE = "LOGOUT_PAGE"; + String PRINCIPAL_ID = "jboss_identity.principal"; String ROLES = "ROLES"; String ROLES_ID = "jboss_identity.roles"; Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-13 23:05:03 UTC (rev 856) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-13 23:06:42 UTC (rev 857) @@ -39,6 +39,7 @@ import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; +import javax.servlet.RequestDispatcher; import javax.servlet.ServletContext; import javax.servlet.ServletException; import javax.servlet.ServletRequest; @@ -132,6 +133,8 @@ protected boolean ignoreSignatures = false; private IRoleValidator roleValidator = new DefaultRoleValidator(); + + private String logOutPage = "/logout.jsp"; public void destroy() { @@ -153,7 +156,11 @@ String samlRequest = request.getParameter("SAMLRequest"); String samlResponse = request.getParameter("SAMLResponse"); - if(!postMethod) + //Eagerly look for Global LogOut + String gloStr = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); + boolean logOutRequest = isNotNull(gloStr) && "true".equalsIgnoreCase(gloStr); + + if(!postMethod && !logOutRequest) { //Check if we are already authenticated if(userPrincipal != null) @@ -210,9 +217,9 @@ { response.sendError(saml2HandlerResponse.getErrorCode()); break; - } - String glo = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); - if(isNotNull(glo) && "true".equalsIgnoreCase(glo)) + } + + if(logOutRequest) saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.LOGOUT); else saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.AUTH); @@ -338,6 +345,21 @@ if(userPrincipal == null) response.sendError(HttpServletResponse.SC_FORBIDDEN);*/ + //See if the session has been invalidated + try + { + session.isNew(); + } + catch(IllegalStateException ise) + { + //we are invalidated. + RequestDispatcher dispatch = context.getRequestDispatcher(this.logOutPage); + if(dispatch == null) + log.error("Cannot dispatch to the logout page: no request dispatcher:" + this.logOutPage); + else + dispatch.forward(request, response); + return; + } filterChain.doFilter(request, servletResponse); } catch (Exception e) @@ -381,6 +403,31 @@ { throw new RuntimeException(e); } + + //Get the Role Validator if configured + String roleValidatorName = filterConfig.getInitParameter(GeneralConstants.ROLE_VALIDATOR); + if(roleValidatorName != null && !"".equals(roleValidatorName)) + { + try + { + Class<?> clazz = SecurityActions.getContextClassLoader().loadClass(roleValidatorName); + this.roleValidator = (IRoleValidator) clazz.newInstance(); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + Map<String,String> options = new HashMap<String, String>(); + String roles = filterConfig.getInitParameter(GeneralConstants.ROLES); + if(trace) + log.trace("Found Roles in SPFilter config="+roles); + if(roles != null) + { + options.put("ROLES", roles); + } + this.roleValidator.intialize(options); //Get the chain from config chain = new DefaultSAML2HandlerChain(); @@ -392,6 +439,7 @@ Map<String, Object> chainConfigOptions = new HashMap<String, Object>(); chainConfigOptions.put(GeneralConstants.CONFIGURATION, spConfiguration); + chainConfigOptions.put(GeneralConstants.ROLE_VALIDATOR, roleValidator); SAML2HandlerChainConfig handlerChainConfig = new DefaultSAML2HandlerChainConfig(chainConfigOptions); Set<SAML2Handler> samlHandlers = chain.handlers(); @@ -437,30 +485,10 @@ log.trace("Key Provider=" + keyProvider.getClassName()); } - //Get the Role Validator if configured - String roleValidatorName = filterConfig.getInitParameter(GeneralConstants.ROLE_VALIDATOR); - if(roleValidatorName != null && !"".equals(roleValidatorName)) - { - try - { - Class<?> clazz = SecurityActions.getContextClassLoader().loadClass(roleValidatorName); - this.roleValidator = (IRoleValidator) clazz.newInstance(); - } - catch (Exception e) - { - throw new RuntimeException(e); - } - } - - Map<String,String> options = new HashMap<String, String>(); - String roles = filterConfig.getInitParameter(GeneralConstants.ROLES); - if(trace) - log.trace("Found Roles in SPFilter config="+roles); - if(roles != null) - { - options.put("ROLES", roles); - } - this.roleValidator.intialize(options); + //see if a global logout page has been configured + String gloPage = filterConfig.getInitParameter(GeneralConstants.LOGOUT_PAGE); + if(gloPage != null && !"".equals(gloPage)) + this.logOutPage = gloPage; } /** Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-13 23:05:03 UTC (rev 856) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-13 23:06:42 UTC (rev 857) @@ -49,6 +49,7 @@ import org.jboss.identity.federation.saml.v2.protocol.StatusCodeType; import org.jboss.identity.federation.saml.v2.protocol.StatusResponseType; import org.jboss.identity.federation.saml.v2.protocol.StatusType; +import org.jboss.identity.federation.web.constants.GeneralConstants; import org.jboss.identity.federation.web.core.HTTPContext; import org.jboss.identity.federation.web.core.IdentityServer; import org.xml.sax.SAXException; @@ -228,7 +229,7 @@ SAML2Request saml2Request = new SAML2Request(); ServletContext servletCtx = httpContext.getServletContext(); - IdentityServer server = (IdentityServer)servletCtx.getAttribute("IDENTITY_SERVER"); + IdentityServer server = (IdentityServer)servletCtx.getAttribute(GeneralConstants.IDENTITY_SERVER); if(server == null) throw new ProcessingException("Identity Server not found"); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-13 23:05:03 UTC (rev 856) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-13 23:06:42 UTC (rev 857) @@ -75,6 +75,7 @@ import org.jboss.identity.federation.saml.v2.protocol.StatusResponseType; import org.jboss.identity.federation.web.constants.GeneralConstants; import org.jboss.identity.federation.web.core.HTTPContext; +import org.jboss.identity.federation.web.core.IdentityServer; import org.jboss.identity.federation.web.roles.DefaultRoleGenerator; import org.jboss.identity.federation.web.util.ConfigurationUtil; import org.jboss.identity.federation.web.util.IDPWebRequestUtil; @@ -219,6 +220,14 @@ this.attributeKeys.add(st.nextToken()); } } + + //Create an Identity Server and set it on the context + IdentityServer identityServer = (IdentityServer) context.getAttribute(GeneralConstants.IDENTITY_SERVER); + if(identityServer == null) + { + identityServer = new IdentityServer(); + context.setAttribute(GeneralConstants.IDENTITY_SERVER, identityServer); + } }