Skip to content
Snippets Groups Projects
Commit 2bf76272 authored by Olav Morken's avatar Olav Morken
Browse files

idp/SingleLogoutServiceiFrameResponse.php: Update to use the SAML2 library. 

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@1618 44740490-163a-0410-bde0-09ae8108e29a
parent ed376a78
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
www/saml2/idp/SingleLogoutServiceiFrameResponse.php
+ 27
− 28
View file @ 2bf76272
...@@ -21,42 +21,47 @@ if (!$config->getValue('enable.saml20-idp', false)) ...@@ -21,42 +21,47 @@ if (!$config->getValue('enable.saml20-idp', false))
SimpleSAML_Utilities::fatalError(isset($session) ? $session->getTrackID() : null, 'NOACCESS'); SimpleSAML_Utilities::fatalError(isset($session) ? $session->getTrackID() : null, 'NOACCESS');
try { try {
$idpentityid = $metadata->getMetaDataCurrentEntityID('saml20-idp-hosted'); $idpEntityId = $metadata->getMetaDataCurrentEntityID('saml20-idp-hosted');
$idpMetadata = $metadata->getMetaDataConfig($idpEntityId, 'saml20-idp-hosted');
} catch (Exception $exception) { } catch (Exception $exception) {
SimpleSAML_Utilities::fatalError($session->getTrackID(), 'METADATA', $exception); SimpleSAML_Utilities::fatalError($session->getTrackID(), 'METADATA', $exception);
} }
SimpleSAML_Logger::debug('SAML2.0 - IdP.SingleLogoutServiceiFrame: Got IdP entity id: ' . $idpentityid); SimpleSAML_Logger::debug('SAML2.0 - IdP.SingleLogoutServiceiFrame: Got IdP entity id: ' . $idpEntityId);
$logouttype = 'traditional';
$idpmeta = $metadata->getMetaDataCurrent('saml20-idp-hosted');
if (array_key_exists('logouttype', $idpmeta)) $logouttype = $idpmeta['logouttype'];
$logouttype = $idpMetadata->getString('logouttype', 'traditional');
if ($logouttype !== 'iframe') if ($logouttype !== 'iframe')
SimpleSAML_Utilities::fatalError($session->getTrackID(), 'NOACCESS', new Exception('This IdP is configured to use logout type [' . $logouttype . '], but this endpoint is only available for IdP using logout type [iframe]')); SimpleSAML_Utilities::fatalError($session->getTrackID(), 'NOACCESS', new Exception('This IdP is configured to use logout type [' . $logouttype . '], but this endpoint is only available for IdP using logout type [iframe]'));
if (!isset($_REQUEST['SAMLResponse'])) {
SimpleSAML_Utilities::fatalError($session->getTrackID(), 'SLOSERVICEPARAMS',
new Exception('No valid SAMLResponse found? Probably some error in remote partys metadata that sends something to this endpoint that is not SAML LogoutResponses') );
}
$binding = SAML2_Binding::getCurrentBinding();;
$logoutResponse = $binding->receive();;
if (!($logoutResponse instanceof SAML2_LogoutResponse)) {
SimpleSAML_Utilities::fatalError($session->getTrackID(), 'SLOSERVICEPARAMS',
new Exception('Message received on response endpoint wasn\'t a response. Was: ' . get_class($logoutResponse)));
}
$spEntityId = $logoutResponse->getIssuer();
if ($spEntityId === NULL) {
SimpleSAML_Utilities::fatalError($session->getTrackID(), 'SLOSERVICEPARAMS',
new Exception('Missing issuer on logout response.'));
}
$spMetadata = $metadata->getMetaDataConfig($spEntityId, 'saml20-sp-remote');
sspmod_saml2_Message::validateMessage($spMetadata, $idpMetadata, $logoutResponse);
if (isset($_GET['SAMLResponse'])) { $sphash = sha1($spEntityId);
setcookie('spstate-' . $sphash , '1'); // Duration: 2 hours
$binding = new SimpleSAML_Bindings_SAML20_HTTPRedirect($config, $metadata); SimpleSAML_Logger::info('SAML2.0 - IdP.SingleLogoutServiceiFrameResponse: Logging out completed');
$logoutresponse = $binding->decodeLogoutResponse($_GET);
/* echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
* This would be the normal way to end SP sessions. But because we do not want concurrent
* updates on the session ojbect, we do set a cookie instead.
*
* $session->set_sp_logout_completed($logoutresponse->getIssuer());
*/
$sphash = sha1($logoutresponse->getIssuer());
setcookie('spstate-' . $sphash , '1'); // Duration: 2 hours
SimpleSAML_Logger::info('SAML2.0 - IdP.SingleLogoutServiceiFrameResponse: Logging out completed');
echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head> <head>
...@@ -65,11 +70,5 @@ if (isset($_GET['SAMLResponse'])) { ...@@ -65,11 +70,5 @@ if (isset($_GET['SAMLResponse'])) {
</head> </head>
<body>OK</body> <body>OK</body>
</html>'; </html>';
} else {
SimpleSAML_Utilities::fatalError($session->getTrackID(), 'SLOSERVICEPARAMS',
new Exception('No valid SAMLResponse found? Probably some error in remote partys metadata that sends something to this endpoint that is not SAML LogoutResponses') );
}
?> ?>
\ No newline at end of file
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment