Examples with SessionIndex com.sun.identity.saml2.protocol.SessionIndex used on opensource projects

Example 6 with SessionIndex

use of com.sun.identity.saml2.protocol.SessionIndex in project OpenAM by OpenRock.

the class SPACSUtils method saveInfoInMemory.

public static void saveInfoInMemory(SessionProvider sessionProvider, Object session, String sessionIndex, String metaAlias, NameIDInfo info, boolean isIDPProxy, boolean isTransient) throws SAML2Exception {
    String infoKeyString = (new NameIDInfoKey(info.getNameIDValue(), info.getHostEntityID(), info.getRemoteEntityID())).toValueString();
    String infoKeyAttribute = AccountUtils.getNameIDInfoKeyAttribute();
    String[] fromToken = null;
    try {
        fromToken = sessionProvider.getProperty(session, infoKeyAttribute);
        if (fromToken == null || fromToken.length == 0 || fromToken[0] == null || fromToken[0].length() == 0) {
            String[] values = { infoKeyString };
            sessionProvider.setProperty(session, infoKeyAttribute, values);
        } else {
            if (fromToken[0].indexOf(infoKeyString) == -1) {
                String[] values = { fromToken[0] + SAML2Constants.SECOND_DELIM + infoKeyString };
                sessionProvider.setProperty(session, infoKeyAttribute, values);
            }
        }
        if (isTransient) {
            String nameIDInfoStr = info.toValueString();
            String infoAttribute = AccountUtils.getNameIDInfoAttribute();
            String[] nameIDInfoStrs = sessionProvider.getProperty(session, infoAttribute);
            if (nameIDInfoStrs == null) {
                nameIDInfoStrs = new String[1];
                nameIDInfoStrs[0] = nameIDInfoStr;
            } else {
                Set nameIDInfoStrSet = new HashSet();
                for (int i = 0; i < nameIDInfoStrs.length; i++) {
                    nameIDInfoStrSet.add(nameIDInfoStrs[i]);
                }
                nameIDInfoStrSet.add(nameIDInfoStr);
                nameIDInfoStrs = (String[]) nameIDInfoStrSet.toArray(new String[nameIDInfoStrSet.size()]);
            }
            sessionProvider.setProperty(session, infoAttribute, nameIDInfoStrs);
        }
    } catch (SessionException sessE) {
        throw new SAML2Exception(sessE);
    }
    String tokenID = sessionProvider.getSessionID(session);
    if (!SPCache.isFedlet) {
        List fedSessions = (List) SPCache.fedSessionListsByNameIDInfoKey.get(infoKeyString);
        if (fedSessions == null) {
            synchronized (SPCache.fedSessionListsByNameIDInfoKey) {
                fedSessions = (List) SPCache.fedSessionListsByNameIDInfoKey.get(infoKeyString);
                if (fedSessions == null) {
                    fedSessions = new ArrayList();
                }
            }
            synchronized (fedSessions) {
                fedSessions.add(new SPFedSession(sessionIndex, tokenID, info, metaAlias));
                SPCache.fedSessionListsByNameIDInfoKey.put(infoKeyString, fedSessions);
            }
            if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
            }
            if (isIDPProxy) {
                //IDP Proxy 
                IDPSession idpSess = (IDPSession) IDPCache.idpSessionsBySessionID.get(tokenID);
                if (idpSess == null) {
                    idpSess = new IDPSession(session);
                    IDPCache.idpSessionsBySessionID.put(tokenID, idpSess);
                }
                if (SAML2Utils.debug.messageEnabled()) {
                    SAML2Utils.debug.message("Add Session Partner: " + info.getRemoteEntityID());
                }
                idpSess.addSessionPartner(new SAML2SessionPartner(info.getRemoteEntityID(), true));
            // end of IDP Proxy        
            }
        } else {
            synchronized (fedSessions) {
                Iterator iter = fedSessions.iterator();
                boolean found = false;
                while (iter.hasNext()) {
                    SPFedSession temp = (SPFedSession) iter.next();
                    String idpSessionIndex = null;
                    if (temp != null) {
                        idpSessionIndex = temp.idpSessionIndex;
                    }
                    if ((idpSessionIndex != null) && (idpSessionIndex.equals(sessionIndex))) {
                        temp.spTokenID = tokenID;
                        temp.info = info;
                        found = true;
                        break;
                    }
                }
                if (!found) {
                    fedSessions.add(new SPFedSession(sessionIndex, tokenID, info, metaAlias));
                    SPCache.fedSessionListsByNameIDInfoKey.put(infoKeyString, fedSessions);
                    if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                        saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
                    }
                }
            }
        }
        SPCache.fedSessionListsByNameIDInfoKey.put(infoKeyString, fedSessions);
        if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
            saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
        }
    }
    try {
        sessionProvider.addListener(session, new SPSessionListener(infoKeyString, tokenID));
    } catch (SessionException e) {
        SAML2Utils.debug.error("SPACSUtils.saveInfoInMemory: " + "Unable to add session listener.");
    }
}

Example 7 with SessionIndex

use of com.sun.identity.saml2.protocol.SessionIndex in project OpenAM by OpenRock.

the class SPSingleLogout method processLogoutRequest.

/**
     * Gets and processes the Single <code>LogoutRequest</code> from IDP
     * and return <code>LogoutResponse</code>.
     *
     * @param logoutReq <code>LogoutRequest</code> from IDP
     * @param spEntityID name of host entity ID.
     * @param realm name of host entity.
     * @param request HTTP servlet request.
     * @param response HTTP servlet response.
     * @param isLBReq true if the request is for load balancing.
     * @param binding value of <code>SAML2Constants.HTTP_REDIRECT</code> or
     *        <code>SAML2Constants.SOAP</code>.
     * @param isVerified true if the request is verified already.
     * @return LogoutResponse the target URL on successful
     * <code>LogoutRequest</code>.
     */
public static LogoutResponse processLogoutRequest(LogoutRequest logoutReq, String spEntityID, String realm, HttpServletRequest request, HttpServletResponse response, boolean isLBReq, boolean destroySession, String binding, boolean isVerified) {
    final String method = "processLogoutRequest : ";
    NameID nameID = null;
    Status status = null;
    Issuer issuer = null;
    String idpEntity = logoutReq.getIssuer().getValue();
    String userId = null;
    try {
        do {
            // TODO: check the NotOnOrAfter attribute of LogoutRequest
            issuer = logoutReq.getIssuer();
            String requestId = logoutReq.getID();
            SAML2Utils.verifyRequestIssuer(realm, spEntityID, issuer, requestId);
            issuer = SAML2Utils.createIssuer(spEntityID);
            // get SessionIndex and NameID form LogoutRequest
            List siList = logoutReq.getSessionIndex();
            int numSI = 0;
            if (siList != null) {
                numSI = siList.size();
                if (debug.messageEnabled()) {
                    debug.message(method + "Number of session indices in the logout request is " + numSI);
                }
            }
            nameID = LogoutUtil.getNameIDFromSLORequest(logoutReq, realm, spEntityID, SAML2Constants.SP_ROLE);
            if (nameID == null) {
                debug.error(method + "LogoutRequest does not contain Name ID");
                status = SAML2Utils.generateStatus(SAML2Constants.RESPONDER, SAML2Utils.bundle.getString("missing_name_identifier"));
                break;
            }
            String infoKeyString = null;
            infoKeyString = (new NameIDInfoKey(nameID.getValue(), spEntityID, idpEntity)).toValueString();
            if (debug.messageEnabled()) {
                debug.message(method + "infokey=" + infoKeyString);
            }
            if (SPCache.isFedlet) {
                // verify request
                if (!isVerified && !LogoutUtil.verifySLORequest(logoutReq, realm, idpEntity, spEntityID, SAML2Constants.SP_ROLE)) {
                    throw new SAML2Exception(SAML2Utils.bundle.getString("invalidSignInRequest"));
                }
                // obtain fedlet adapter
                FedletAdapter fedletAdapter = SAML2Utils.getFedletAdapterClass(spEntityID, realm);
                boolean result = false;
                if (fedletAdapter != null) {
                    // call adapter to do real logout
                    result = fedletAdapter.doFedletSLO(request, response, logoutReq, spEntityID, idpEntity, siList, nameID.getValue(), binding);
                }
                if (result) {
                    status = SUCCESS_STATUS;
                } else {
                    status = SAML2Utils.generateStatus(SAML2Constants.RESPONDER, SAML2Utils.bundle.getString("appLogoutFailed"));
                }
                break;
            }
            List list = (List) SPCache.fedSessionListsByNameIDInfoKey.get(infoKeyString);
            if (debug.messageEnabled()) {
                debug.message(method + "SPFedsessions=" + list);
            }
            if ((list == null) || list.isEmpty()) {
                String spQ = nameID.getSPNameQualifier();
                if ((spQ == null) || (spQ.length() == 0)) {
                    infoKeyString = (new NameIDInfoKey(nameID.getValue(), spEntityID, nameID.getNameQualifier())).toValueString();
                    list = (List) SPCache.fedSessionListsByNameIDInfoKey.get(infoKeyString);
                }
            }
            boolean foundPeer = false;
            List remoteServiceURLs = null;
            if (isLBReq) {
                remoteServiceURLs = FSUtils.getRemoteServiceURLs(request);
                foundPeer = remoteServiceURLs != null && !remoteServiceURLs.isEmpty();
            }
            if (debug.messageEnabled()) {
                debug.message(method + "isLBReq = " + isLBReq + ", foundPeer = " + foundPeer);
            }
            if (list == null || list.isEmpty()) {
                if (foundPeer) {
                    boolean peerError = false;
                    for (Iterator iter = remoteServiceURLs.iterator(); iter.hasNext(); ) {
                        String remoteLogoutURL = getRemoteLogoutURL((String) iter.next(), request);
                        LogoutResponse logoutRes = LogoutUtil.forwardToRemoteServer(logoutReq, remoteLogoutURL);
                        if ((logoutRes != null) && !isNameNotFound(logoutRes)) {
                            if (isSuccess(logoutRes)) {
                                if (numSI > 0) {
                                    siList = LogoutUtil.getSessionIndex(logoutRes);
                                    if (siList == null || siList.isEmpty()) {
                                        peerError = false;
                                        break;
                                    }
                                }
                            } else {
                                peerError = true;
                            }
                        }
                    }
                    if (peerError || (siList != null && siList.size() > 0)) {
                        status = PARTIAL_LOGOUT_STATUS;
                    } else {
                        status = SUCCESS_STATUS;
                    }
                } else {
                    debug.error(method + "invalid Name ID received");
                    status = SAML2Utils.generateStatus(SAML2Constants.RESPONDER, SAML2Utils.bundle.getString("invalid_name_identifier"));
                }
                break;
            } else {
                // find the session, do signature validation
                if (!isVerified && !LogoutUtil.verifySLORequest(logoutReq, realm, logoutReq.getIssuer().getValue(), spEntityID, SAML2Constants.SP_ROLE)) {
                    throw new SAML2Exception(SAML2Utils.bundle.getString("invalidSignInRequest"));
                }
                // invoke SPAdapter for preSingleLogoutProcess
                try {
                    String tokenId = ((SPFedSession) list.iterator().next()).spTokenID;
                    Object token = sessionProvider.getSession(tokenId);
                    userId = sessionProvider.getPrincipalName(token);
                    if (SAML2Utils.debug.messageEnabled()) {
                        SAML2Utils.debug.message("SPSingleLogout." + "processLogoutRequest, user = " + userId);
                    }
                } catch (SessionException ex) {
                    if (SAML2Utils.debug.messageEnabled()) {
                        SAML2Utils.debug.message("SPSingleLogout." + "processLogoutRequest", ex);
                    }
                }
                userId = preSingleLogoutProcess(spEntityID, realm, request, response, userId, logoutReq, null, binding);
            }
            // get application logout URL 
            BaseConfigType spConfig = SAML2Utils.getSAML2MetaManager().getSPSSOConfig(realm, spEntityID);
            List appLogoutURL = (List) SAML2MetaUtils.getAttributes(spConfig).get(SAML2Constants.APP_LOGOUT_URL);
            if (debug.messageEnabled()) {
                debug.message("IDPLogoutUtil.processLogoutRequest: " + "external app logout URL= " + appLogoutURL);
            }
            if (numSI == 0) {
                // logout all fed sessions for this user
                // between this SP and the IDP
                List tokenIDsToBeDestroyed = new ArrayList();
                synchronized (list) {
                    Iterator iter = list.listIterator();
                    while (iter.hasNext()) {
                        SPFedSession fedSession = (SPFedSession) iter.next();
                        tokenIDsToBeDestroyed.add(fedSession.spTokenID);
                        iter.remove();
                        if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                            saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
                        }
                    }
                }
                for (Iterator iter = tokenIDsToBeDestroyed.listIterator(); iter.hasNext(); ) {
                    String tokenID = (String) iter.next();
                    Object token = null;
                    try {
                        token = sessionProvider.getSession(tokenID);
                    } catch (SessionException se) {
                        debug.error(method + "Could not create session from token ID = " + tokenID);
                        continue;
                    }
                    if (debug.messageEnabled()) {
                        debug.message(method + "destroy token " + tokenID);
                    }
                    // handle external application logout if configured
                    if ((appLogoutURL != null) && (appLogoutURL.size() != 0)) {
                        SAML2Utils.postToAppLogout(request, (String) appLogoutURL.get(0), token);
                    }
                    if (destroySession) {
                        sessionProvider.invalidateSession(token, request, response);
                    }
                }
                if (foundPeer) {
                    boolean peerError = false;
                    for (Iterator iter = remoteServiceURLs.iterator(); iter.hasNext(); ) {
                        String remoteLogoutURL = getRemoteLogoutURL((String) iter.next(), request);
                        LogoutResponse logoutRes = LogoutUtil.forwardToRemoteServer(logoutReq, remoteLogoutURL);
                        if ((logoutRes == null) || !(isSuccess(logoutRes) || isNameNotFound(logoutRes))) {
                            peerError = true;
                        }
                    }
                    if (peerError) {
                        status = PARTIAL_LOGOUT_STATUS;
                    } else {
                        status = SUCCESS_STATUS;
                    }
                }
            } else {
                // logout only those fed sessions specified
                // in logout request session list
                String sessionIndex = null;
                List siNotFound = new ArrayList();
                for (int i = 0; i < numSI; i++) {
                    sessionIndex = (String) siList.get(i);
                    String tokenIDToBeDestroyed = null;
                    synchronized (list) {
                        Iterator iter = list.listIterator();
                        while (iter.hasNext()) {
                            SPFedSession fedSession = (SPFedSession) iter.next();
                            if (sessionIndex.equals(fedSession.idpSessionIndex)) {
                                if (debug.messageEnabled()) {
                                    debug.message(method + " found si + " + sessionIndex);
                                }
                                tokenIDToBeDestroyed = fedSession.spTokenID;
                                iter.remove();
                                if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                                    saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
                                }
                                break;
                            }
                        }
                    }
                    if (tokenIDToBeDestroyed != null) {
                        try {
                            Object token = sessionProvider.getSession(tokenIDToBeDestroyed);
                            if (debug.messageEnabled()) {
                                debug.message(method + "destroy token (2) " + tokenIDToBeDestroyed);
                            }
                            // handle external application logout 
                            if ((appLogoutURL != null) && (appLogoutURL.size() != 0)) {
                                SAML2Utils.postToAppLogout(request, (String) appLogoutURL.get(0), token);
                            }
                            if (destroySession) {
                                sessionProvider.invalidateSession(token, request, response);
                            }
                        } catch (SessionException se) {
                            debug.error(method + "Could not create " + "session from token ID = " + tokenIDToBeDestroyed);
                        }
                    } else {
                        siNotFound.add(sessionIndex);
                    }
                }
                if (isLBReq) {
                    if (foundPeer && !siNotFound.isEmpty()) {
                        boolean peerError = false;
                        LogoutRequest lReq = copyAndMakeMutable(logoutReq);
                        for (Iterator iter = remoteServiceURLs.iterator(); iter.hasNext(); ) {
                            lReq.setSessionIndex(siNotFound);
                            String remoteLogoutURL = getRemoteLogoutURL((String) iter.next(), request);
                            LogoutResponse logoutRes = LogoutUtil.forwardToRemoteServer(lReq, remoteLogoutURL);
                            if ((logoutRes != null) && !isNameNotFound(logoutRes)) {
                                if (isSuccess(logoutRes)) {
                                    siNotFound = LogoutUtil.getSessionIndex(logoutRes);
                                } else {
                                    peerError = true;
                                }
                            }
                            if (debug.messageEnabled()) {
                                debug.message(method + "siNotFound = " + siNotFound);
                            }
                            if (siNotFound == null || siNotFound.isEmpty()) {
                                peerError = false;
                                break;
                            }
                        }
                        if (peerError || (siNotFound != null && !siNotFound.isEmpty())) {
                            status = PARTIAL_LOGOUT_STATUS;
                        } else {
                            status = SUCCESS_STATUS;
                        }
                    } else {
                        status = SUCCESS_STATUS;
                    }
                } else {
                    if (siNotFound.isEmpty()) {
                        status = SUCCESS_STATUS;
                    } else {
                        status = SAML2Utils.generateStatus(SAML2Constants.SUCCESS, SAML2Utils.bundle.getString("requestSuccess"));
                        LogoutUtil.setSessionIndex(status, siNotFound);
                    }
                }
            }
        } while (false);
    } catch (SessionException se) {
        debug.error("processLogoutRequest: ", se);
        status = SAML2Utils.generateStatus(SAML2Constants.RESPONDER, se.toString());
    } catch (SAML2Exception e) {
        debug.error("processLogoutRequest: " + "failed to create response", e);
        status = SAML2Utils.generateStatus(SAML2Constants.RESPONDER, e.toString());
    }
    // create LogoutResponse
    if (spEntityID == null) {
        spEntityID = nameID.getSPNameQualifier();
    }
    LogoutResponse logResponse = LogoutUtil.generateResponse(status, logoutReq.getID(), issuer, realm, SAML2Constants.SP_ROLE, idpEntity);
    if (isSuccess(logResponse)) {
        // invoke SPAdapter for postSingleLogoutSuccess
        postSingleLogoutSuccess(spEntityID, realm, request, response, userId, logoutReq, logResponse, binding);
    }
    return logResponse;
}

Example 8 with SessionIndex

use of com.sun.identity.saml2.protocol.SessionIndex in project OpenAM by OpenRock.

the class SPSingleLogout method prepareForLogout.

private static String prepareForLogout(String realm, String tokenID, String metaAlias, List extensionsList, String binding, String relayState, HttpServletRequest request, HttpServletResponse response, Map paramsMap, String infoKeyString, LogoutRequest origLogoutRequest, SOAPMessage msg) throws SAML2Exception, SessionException {
    NameIDInfoKey nameIdInfoKey = NameIDInfoKey.parse(infoKeyString);
    String sessionIndex = null;
    NameID nameID = null;
    if (SPCache.isFedlet) {
        sessionIndex = SAML2Utils.getParameter(paramsMap, SAML2Constants.SESSION_INDEX);
        nameID = AssertionFactory.getInstance().createNameID();
        nameID.setValue(nameIdInfoKey.getNameIDValue());
        nameID.setFormat(SAML2Constants.NAMEID_TRANSIENT_FORMAT);
        nameID.setNameQualifier(nameIdInfoKey.getRemoteEntityID());
        nameID.setSPNameQualifier(nameIdInfoKey.getHostEntityID());
    } else {
        SPFedSession fedSession = null;
        List list = (List) SPCache.fedSessionListsByNameIDInfoKey.get(infoKeyString);
        if (list != null) {
            synchronized (list) {
                ListIterator iter = list.listIterator();
                while (iter.hasNext()) {
                    fedSession = (SPFedSession) iter.next();
                    if (tokenID.equals(fedSession.spTokenID)) {
                        iter.remove();
                        if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                            saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
                        }
                        if (list.size() == 0) {
                            SPCache.fedSessionListsByNameIDInfoKey.remove(infoKeyString);
                        }
                        break;
                    }
                    fedSession = null;
                }
            }
        }
        if (fedSession == null) {
            // just do local logout
            if (debug.messageEnabled()) {
                debug.message("No session partner, just do local logout.");
            }
            return null;
        }
        sessionIndex = fedSession.idpSessionIndex;
        nameID = fedSession.info.getNameID();
    }
    // get IDPSSODescriptor
    IDPSSODescriptorElement idpsso = sm.getIDPSSODescriptor(realm, nameIdInfoKey.getRemoteEntityID());
    if (idpsso == null) {
        String[] data = { nameIdInfoKey.getRemoteEntityID() };
        LogUtil.error(Level.INFO, LogUtil.IDP_METADATA_ERROR, data, null);
        throw new SAML2Exception(SAML2Utils.bundle.getString("metaDataError"));
    }
    List slosList = idpsso.getSingleLogoutService();
    if (slosList == null) {
        String[] data = { nameIdInfoKey.getRemoteEntityID() };
        LogUtil.error(Level.INFO, LogUtil.SLO_NOT_FOUND, data, null);
        throw new SAML2Exception(SAML2Utils.bundle.getString("sloServiceListNotfound"));
    }
    // get IDP entity config in case of SOAP, for basic auth info
    IDPSSOConfigElement idpConfig = null;
    if (binding.equals(SAML2Constants.SOAP)) {
        idpConfig = sm.getIDPSSOConfig(realm, nameIdInfoKey.getRemoteEntityID());
    }
    StringBuffer requestID = LogoutUtil.doLogout(metaAlias, nameIdInfoKey.getRemoteEntityID(), slosList, extensionsList, binding, relayState, sessionIndex, nameID, request, response, paramsMap, idpConfig);
    String requestIDStr = requestID.toString();
    if (debug.messageEnabled()) {
        debug.message("\nSPSLO.requestIDStr = " + requestIDStr + "\nbinding = " + binding);
    }
    if ((requestIDStr != null) && (requestIDStr.length() != 0) && (binding.equals(SAML2Constants.HTTP_REDIRECT) || binding.equals(SAML2Constants.HTTP_POST)) && (origLogoutRequest != null)) {
        IDPCache.proxySPLogoutReqCache.put(requestIDStr, origLogoutRequest);
    } else if ((requestIDStr != null) && (requestIDStr.length() != 0) && binding.equals(SAML2Constants.SOAP) && (msg != null)) {
        IDPCache.SOAPMessageByLogoutRequestID.put(requestIDStr, msg);
    }
    return requestIDStr;
}

Example 9 with SessionIndex

use of com.sun.identity.saml2.protocol.SessionIndex in project OpenAM by OpenRock.

the class LogoutUtil method doLogout.

public static StringBuffer doLogout(String metaAlias, String recipientEntityID, List extensionsList, EndpointType logoutEndpoint, String relayState, String sessionIndex, NameID nameID, HttpServletRequest request, HttpServletResponse response, Map paramsMap, BaseConfigType config) throws SAML2Exception, SessionException {
    StringBuffer logoutRequestID = new StringBuffer();
    String classMethod = "LogoutUtil.doLogout: ";
    String requesterEntityID = metaManager.getEntityByMetaAlias(metaAlias);
    String realm = SAML2MetaUtils.getRealmByMetaAlias(metaAlias);
    String hostEntityRole = SAML2Utils.getHostEntityRole(paramsMap);
    String location = null;
    String binding = null;
    if (logoutEndpoint != null) {
        location = logoutEndpoint.getLocation();
        binding = logoutEndpoint.getBinding();
    } else {
        debug.error(classMethod + "Unable to find the recipient's single logout service with the binding " + binding);
        throw new SAML2Exception(SAML2Utils.bundle.getString("sloServiceNotfound"));
    }
    if (debug.messageEnabled()) {
        debug.message(classMethod + "Entering ..." + "\nrequesterEntityID=" + requesterEntityID + "\nrecipientEntityID=" + recipientEntityID + "\nbinding=" + binding + "\nrelayState=" + relayState + "\nsessionIndex=" + sessionIndex);
    }
    // generate unique request ID
    String requestID = SAML2Utils.generateID();
    if ((requestID == null) || (requestID.length() == 0)) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("cannotGenerateID"));
    }
    // retrieve data from the params map
    // destinationURI required if message is signed.
    String destinationURI = SAML2Utils.getParameter(paramsMap, SAML2Constants.DESTINATION);
    String consent = SAML2Utils.getParameter(paramsMap, SAML2Constants.CONSENT);
    Extensions extensions = createExtensions(extensionsList);
    Issuer issuer = SAML2Utils.createIssuer(requesterEntityID);
    // construct LogoutRequest
    LogoutRequest logoutReq = null;
    try {
        logoutReq = ProtocolFactory.getInstance().createLogoutRequest();
    } catch (Exception e) {
        debug.error(classMethod + "Unable to create LogoutRequest : ", e);
        throw new SAML2Exception(SAML2Utils.bundle.getString("errorCreatingLogoutRequest"));
    }
    // set required attributes / elements
    logoutReq.setID(requestID);
    logoutReq.setVersion(SAML2Constants.VERSION_2_0);
    logoutReq.setIssueInstant(new Date());
    setNameIDForSLORequest(logoutReq, nameID, realm, requesterEntityID, hostEntityRole, recipientEntityID);
    // set optional attributes / elements
    logoutReq.setDestination(XMLUtils.escapeSpecialCharacters(destinationURI));
    logoutReq.setConsent(consent);
    logoutReq.setIssuer(issuer);
    if (hostEntityRole.equals(SAML2Constants.IDP_ROLE)) {
        // use the assertion effective time (in seconds)
        int effectiveTime = SAML2Constants.ASSERTION_EFFECTIVE_TIME;
        String effectiveTimeStr = SAML2Utils.getAttributeValueFromSSOConfig(realm, requesterEntityID, SAML2Constants.IDP_ROLE, SAML2Constants.ASSERTION_EFFECTIVE_TIME_ATTRIBUTE);
        if (effectiveTimeStr != null) {
            try {
                effectiveTime = Integer.parseInt(effectiveTimeStr);
                if (SAML2Utils.debug.messageEnabled()) {
                    SAML2Utils.debug.message(classMethod + "got effective time from config:" + effectiveTime);
                }
            } catch (NumberFormatException nfe) {
                SAML2Utils.debug.error(classMethod + "Failed to get assertion effective time from " + "IDP SSO config: ", nfe);
                effectiveTime = SAML2Constants.ASSERTION_EFFECTIVE_TIME;
            }
        }
        Date date = new Date();
        date.setTime(date.getTime() + effectiveTime * 1000);
        logoutReq.setNotOnOrAfter(date);
    }
    if (extensions != null) {
        logoutReq.setExtensions(extensions);
    }
    if (sessionIndex != null) {
        List list = new ArrayList();
        list.add(sessionIndex);
        logoutReq.setSessionIndex(list);
    }
    debug.message(classMethod + "Recipient's single logout service location = " + location);
    if (destinationURI == null || destinationURI.isEmpty()) {
        logoutReq.setDestination(XMLUtils.escapeSpecialCharacters(location));
    }
    if (debug.messageEnabled()) {
        debug.message(classMethod + "SLO Request before signing : ");
        debug.message(logoutReq.toXMLString(true, true));
    }
    if (binding.equals(SAML2Constants.HTTP_REDIRECT)) {
        try {
            doSLOByHttpRedirect(logoutReq.toXMLString(true, true), location, relayState, realm, requesterEntityID, hostEntityRole, recipientEntityID, response);
            logoutRequestID.append(requestID);
            String[] data = { location };
            LogUtil.access(Level.INFO, LogUtil.REDIRECT_TO_IDP, data, null);
        } catch (Exception e) {
            debug.error("Exception :", e);
            throw new SAML2Exception(SAML2Utils.bundle.getString("errorRedirectingLogoutRequest"));
        }
    } else if (binding.equals(SAML2Constants.SOAP)) {
        logoutRequestID.append(requestID);
        signSLORequest(logoutReq, realm, requesterEntityID, hostEntityRole, recipientEntityID);
        if (debug.messageEnabled()) {
            debug.message(classMethod + "SLO Request after signing : ");
            debug.message(logoutReq.toXMLString(true, true));
        }
        location = SAML2Utils.fillInBasicAuthInfo(config, location);
        doSLOBySOAP(requestID, logoutReq, location, realm, requesterEntityID, hostEntityRole, request, response);
    } else if (binding.equals(SAML2Constants.HTTP_POST)) {
        logoutRequestID.append(requestID);
        signSLORequest(logoutReq, realm, requesterEntityID, hostEntityRole, recipientEntityID);
        if (debug.messageEnabled()) {
            debug.message(classMethod + "SLO Request after signing : ");
            debug.message(logoutReq.toXMLString(true, true));
        }
        doSLOByPOST(requestID, logoutReq.toXMLString(true, true), location, relayState, realm, requesterEntityID, hostEntityRole, response, request);
    }
    SPCache.logoutRequestIDHash.put(logoutRequestID.toString(), logoutReq);
    return logoutRequestID;
}

Example 10 with SessionIndex

use of com.sun.identity.saml2.protocol.SessionIndex in project OpenAM by OpenRock.

the class SAML2PostAuthenticationPlugin method setupSingleLogOut.

private void setupSingleLogOut(SSOToken ssoToken, String metaAlias, String sessionIndex, String spEntityId, String idpEntityId, NameID nameId) throws SSOException, SAML2Exception, SessionException {
    final SAML2MetaManager sm = new SAML2MetaManager();
    final String realm = SAML2MetaUtils.getRealmByMetaAlias(metaAlias);
    final String relayState = ssoToken.getProperty(SAML2Constants.RELAY_STATE);
    final String binding = SAML2Constants.HTTP_REDIRECT;
    final IDPSSODescriptorElement idpsso = sm.getIDPSSODescriptor(realm, idpEntityId);
    final List<EndpointType> slosList = idpsso.getSingleLogoutService();
    EndpointType logoutEndpoint = null;
    for (EndpointType endpoint : slosList) {
        if (binding.equals(endpoint.getBinding())) {
            logoutEndpoint = endpoint;
            break;
        }
    }
    if (logoutEndpoint == null) {
        DEBUG.warning("Unable to determine SLO endpoint. Aborting SLO attempt. Please note this PAP " + "only supports HTTP-Redirect as a valid binding.");
        return;
    }
    final LogoutRequest logoutReq = createLogoutRequest(metaAlias, realm, idpEntityId, logoutEndpoint, nameId, sessionIndex);
    //survival time is one hours
    //counted in seconds
    final long sessionExpireTime = System.currentTimeMillis() / 1000 + SPCache.interval;
    final String sloRequestXMLString = logoutReq.toXMLString(true, true);
    final String redirect = getRedirectURL(sloRequestXMLString, relayState, realm, idpEntityId, logoutEndpoint.getLocation(), spEntityId);
    if (SAML2FailoverUtils.isSAML2FailoverEnabled()) {
        try {
            SAML2FailoverUtils.saveSAML2TokenWithoutSecondaryKey(logoutReq.getID(), logoutReq, sessionExpireTime);
        } catch (SAML2TokenRepositoryException e) {
            DEBUG.warning("Unable to set SLO redirect location. Aborting SLO attempt.");
            return;
        }
    } else {
        SAML2Store.saveTokenWithKey(logoutReq.getID(), logoutReq);
    }
    ssoToken.setProperty(SLO_SESSION_LOCATION, logoutEndpoint.getLocation());
    ssoToken.setProperty(SLO_SESSION_REFERENCE, redirect);
}