diff --git a/modules/saml2/lib/Auth/Source/SP.php b/modules/saml2/lib/Auth/Source/SP.php index c5730a09e508b35f48b69c41a552ab5384c93055..3f17262298177a69ab7e232616cec01e517f0d18 100644 --- a/modules/saml2/lib/Auth/Source/SP.php +++ b/modules/saml2/lib/Auth/Source/SP.php @@ -244,16 +244,20 @@ class sspmod_saml2_Auth_Source_SP extends SimpleSAML_Auth_Source { $nameId = $state[self::LOGOUT_NAMEID]; $sessionIndex = $state[self::LOGOUT_SESSIONINDEX]; - $config = SimpleSAML_Configuration::getInstance(); $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler(); + $spMetadata = $metadata->getMetaDataConfig($this->getEntityId(), 'saml20-sp-hosted'); + $idpMetadata = $metadata->getMetaDataConfig($idp, 'saml20-idp-remote'); - $lr = new SimpleSAML_XML_SAML20_LogoutRequest($config, $metadata); - $req = $lr->generate($this->entityId, $idp, $nameId, $sessionIndex, 'SP'); + $lr = sspmod_saml2_Message::buildLogoutRequest($spMetadata, $idpMetadata); + $lr->setNameId($nameId); + $lr->setSessionIndex($sessionIndex); + $lr->setRelayState($id); - $httpredirect = new SimpleSAML_Bindings_SAML20_HTTPRedirect($config, $metadata); - $httpredirect->sendMessage($req, $this->entityId, $idp, $id, 'SingleLogoutService', 'SAMLRequest', 'SP'); + $b = new SAML2_HTTPRedirect(); + $b->setDestination(sspmod_SAML2_Message::getDebugDestination()); + $b->send($lr); - exit(0); + assert('FALSE'); } diff --git a/modules/saml2/lib/Message.php b/modules/saml2/lib/Message.php index fd51160ca047203ff9eb166ed35e1ee9d91d60be..c332a3693f4beaaeb9774ac79ba312e9c976518d 100644 --- a/modules/saml2/lib/Message.php +++ b/modules/saml2/lib/Message.php @@ -100,6 +100,25 @@ class sspmod_saml2_Message { return $ar; } + + /** + * Build a logout request based on information in the metadata. + * + * @param SimpleSAML_Configuration $srcMetadata The metadata of the sender. + * @param SimpleSAML_Configuration $dstpMetadata The metadata of the recipient. + */ + public static function buildLogoutRequest(SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata) { + + $lr = new SAML2_LogoutRequest(); + + $lr->setIssuer($srcMetadata->getString('entityid')); + $lr->setDestination($dstMetadata->getString('SingleLogoutService')); + + self::addSign($srcMetadata, $dstMetadata, $lr); + + return $lr; + } + } ?> \ No newline at end of file diff --git a/modules/saml2/www/sp/acs.php b/modules/saml2/www/sp/acs.php index 57d26db67967b16bb2393268caacfdb2cca81b65..a43c70dbb686ae1e600396b39163d6603001ed6d 100644 --- a/modules/saml2/www/sp/acs.php +++ b/modules/saml2/www/sp/acs.php @@ -46,10 +46,18 @@ if (!$source->isIdPValid($idp)) { '. The IdP was ' . var_export($idp, TRUE)); } +/* + * Retrieve the name identifier. We also convert it to the format used by the + * logout request handler. + */ +$nameId = $authnResponse->getNameID(); +$nameId['Value'] = $nameId['value']; +unset($nameId['value']); + /* We need to save the NameID and SessionIndex for logout. */ $logoutState = array( sspmod_saml2_Auth_Source_SP::LOGOUT_IDP => $idp, - sspmod_saml2_Auth_Source_SP::LOGOUT_NAMEID => $authnResponse->getNameID(), + sspmod_saml2_Auth_Source_SP::LOGOUT_NAMEID => $nameId, sspmod_saml2_Auth_Source_SP::LOGOUT_SESSIONINDEX => $authnResponse->getSessionIndex(), ); $state['LogoutState'] = $logoutState;