saml2: Use SAML library for logout requests.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@1607 44740490-163a-0410-bde0-09ae8108e29a

modules/saml2/lib/Auth/Source/SP.php

@@ -244,16 +244,20 @@ class sspmod_saml2_Auth_Source_SP extends SimpleSAML_Auth_Source {
 		$nameId = $state[self::LOGOUT_NAMEID];
 		$sessionIndex = $state[self::LOGOUT_SESSIONINDEX];
 
-		$config = SimpleSAML_Configuration::getInstance();
 		$metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
+		$spMetadata = $metadata->getMetaDataConfig($this->getEntityId(), 'saml20-sp-hosted');
+		$idpMetadata = $metadata->getMetaDataConfig($idp, 'saml20-idp-remote');
 
-		$lr = new SimpleSAML_XML_SAML20_LogoutRequest($config, $metadata);
-		$req = $lr->generate($this->entityId, $idp, $nameId, $sessionIndex, 'SP');
+		$lr = sspmod_saml2_Message::buildLogoutRequest($spMetadata, $idpMetadata);
+		$lr->setNameId($nameId);
+		$lr->setSessionIndex($sessionIndex);
+		$lr->setRelayState($id);
 
-		$httpredirect = new SimpleSAML_Bindings_SAML20_HTTPRedirect($config, $metadata);
-		$httpredirect->sendMessage($req, $this->entityId, $idp, $id, 'SingleLogoutService', 'SAMLRequest', 'SP');
+		$b = new SAML2_HTTPRedirect();
+		$b->setDestination(sspmod_SAML2_Message::getDebugDestination());
+		$b->send($lr);
 
-		exit(0);
+		assert('FALSE');
 	}
 
 

modules/saml2/lib/Message.php

@@ -100,6 +100,25 @@ class sspmod_saml2_Message {
 		return $ar;
 	}
 
+
+	/**
+	 * Build a logout request based on information in the metadata.
+	 *
+	 * @param SimpleSAML_Configuration $srcMetadata  The metadata of the sender.
+	 * @param SimpleSAML_Configuration $dstpMetadata  The metadata of the recipient.
+	 */
+	public static function buildLogoutRequest(SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata) {
+
+		$lr = new SAML2_LogoutRequest();
+
+		$lr->setIssuer($srcMetadata->getString('entityid'));
+		$lr->setDestination($dstMetadata->getString('SingleLogoutService'));
+
+		self::addSign($srcMetadata, $dstMetadata, $lr);
+
+		return $lr;
+	}
+
 }
 
 ?>
\ No newline at end of file

modules/saml2/www/sp/acs.php

@@ -46,10 +46,18 @@ if (!$source->isIdPValid($idp)) {
 		'. The IdP was ' . var_export($idp, TRUE));
 }
 
+/*
+ * Retrieve the name identifier. We also convert it to the format used by the
+ * logout request handler.
+ */
+$nameId = $authnResponse->getNameID();
+$nameId['Value'] = $nameId['value'];
+unset($nameId['value']);
+
 /* We need to save the NameID and SessionIndex for logout. */
 $logoutState = array(
 	sspmod_saml2_Auth_Source_SP::LOGOUT_IDP => $idp,
-	sspmod_saml2_Auth_Source_SP::LOGOUT_NAMEID => $authnResponse->getNameID(),
+	sspmod_saml2_Auth_Source_SP::LOGOUT_NAMEID => $nameId,
 	sspmod_saml2_Auth_Source_SP::LOGOUT_SESSIONINDEX => $authnResponse->getSessionIndex(),
 	);
 $state['LogoutState'] = $logoutState;