Merge pull request #358 from mwey/feature-slo-response-location

Feature support: SLO ResponseLocation

README.md

@@ -375,6 +375,9 @@ $settings = array (
  'singleLogoutService' => array (
  // URL Location of the IdP where SLO Request will be sent.
  'url' => '',
+ // URL location of the IdP where the SP will send the SLO Response (ResponseLocation)
+ // if not set, url for the SLO Request will be used
+ 'responseUrl' => '', 
  // SAML protocol binding to be used when returning the <Response>
  // message. OneLogin Toolkit supports the HTTP-Redirect binding
  // only for this endpoint.

lib/Saml2/Auth.php

@@ -285,7 +285,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
  $parameters['Signature'] = $signature;
  }
 
- return $this->redirectTo($this->getSLOurl(), $parameters, $stay);
+ return $this->redirectTo($this->getSLOResponseUrl(), $parameters, $stay);
  }
  } else {
  $this->_errors[] = 'invalid_binding';
@@ -581,6 +581,20 @@ public function getSLOurl()
  return $url;
  }
 
+ /**
+ * Gets the SLO response url.
+ *
+ * @return string|null The response url of the Single Logout Service
+ */
+ public function getSLOResponseUrl()
+ {
+ $idpData = $this->_settings->getIdPData();
+ if (isset($idpData['singleLogoutService']) && isset($idpData['singleLogoutService']['responseUrl'])) {
+ return $idpData['singleLogoutService']['responseUrl'];
+ }
+ return $this->getSLOurl();
+ }
+
  /**
  * Gets the ID of the last AuthNRequest or LogoutRequest generated by the Service Provider.
  *

lib/Saml2/IdPMetadataParser.php

@@ -140,6 +140,7 @@ public static function parseXML($xml, $entityId = null, $desiredNameIdFormat = n
  if ($sloNodes->length > 0) {
  $metadataInfo['idp']['singleLogoutService'] = array(
  'url' => $sloNodes->item(0)->getAttribute('Location'),
+ 'responseUrl' => $sloNodes->item(0)->getAttribute('ResponseLocation'),
  'binding' => $sloNodes->item(0)->getAttribute('Binding')
  );
  }

lib/Saml2/Settings.php

@@ -531,6 +531,14 @@ public function checkIdPSettings($settings)
  $errors[] = 'idp_slo_url_invalid';
  }
 
+ if (isset($idp['singleLogoutService'])
+ && isset($idp['singleLogoutService']['responseUrl'])
+ && !empty($idp['singleLogoutService']['responseUrl'])
+ && !filter_var($idp['singleLogoutService']['responseUrl'], FILTER_VALIDATE_URL)
+ ) {
+ $errors[] = 'idp_slo_response_url_invalid';
+ }
+
  if (isset($settings['security'])) {
  $security = $settings['security'];
 

settings_example.php

@@ -93,6 +93,9 @@
  'singleLogoutService' => array (
  // URL Location of the IdP where the SP will send the SLO Request
  'url' => '',
+ // URL location of the IdP where the SP will send the SLO Response (ResponseLocation)
+ // if not set, url for the SLO Request will be used
+ 'responseUrl' => '',
  // SAML protocol binding to be used when returning the <Response>
  // message. Onelogin Toolkit supports for this endpoint the
  // HTTP-Redirect binding only

tests/data/metadata/idp/metadata.xml

@@ -68,7 +68,7 @@ WQO0LPxPqRiUqUzyhDhLo/xXNrHCu4VbMw==</ds:X509Certificate>
  </ds:X509Data>
  </ds:KeyInfo>
  </KeyDescriptor>
- <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.examle.com/saml/slo"/> 
+ <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.examle.com/saml/slo" ResponseLocation="https://idp.examle.com/saml/slr"/>
  <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
  <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.examle.com/saml/sso"/>
  </IDPSSODescriptor>

tests/settings/settings1.php

@@ -19,6 +19,7 @@
  ),
  'singleLogoutService' => array (
  'url' => 'http://idp.example.com/SingleLogoutService.php',
+ 'responseUrl' => 'http://idp.example.com/SingleLogoutServiceResponse.php',
  ),
  'x509cert' => 'MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo',
  ),

tests/src/OneLogin/Saml2/AuthTest.php

@@ -79,6 +79,17 @@ public function testGetSLOurl()
  $this->assertEquals($this->_auth->getSLOurl(), $sloUrl);
  }
 
+ /**
+ * Tests the getSLOResponseUrl method of the OneLogin_Saml2_Auth class
+ *
+ * @covers OneLogin_Saml2_Auth::getSLOurl
+ */
+ public function testGetSLOResponseUrl()
+ {
+ $sloResponseUrl = $this->_settingsInfo['idp']['singleLogoutService']['responseUrl'];
+ $this->assertEquals($this->_auth->getSLOResponseUrl(), $sloResponseUrl);
+ }
+
  /**
  * Tests the processResponse method of the OneLogin_Saml2_Auth class
  * Case No Response, An exception is throw
@@ -548,8 +559,8 @@ public function testProcessSLORequestInvalidValid()
  $parsedQuery = getParamsFromUrl($targetUrl);
 
  $this->assertEmpty($this->_auth->getErrors());
- $sloUrl = $this->_settingsInfo['idp']['singleLogoutService']['url'];
- $this->assertContains($sloUrl, $targetUrl);
+ $sloResponseUrl = $this->_settingsInfo['idp']['singleLogoutService']['responseUrl'];
+ $this->assertContains($sloResponseUrl, $targetUrl);
  $this->assertArrayHasKey('SAMLResponse', $parsedQuery);
  $this->assertArrayNotHasKey('RelayState', $parsedQuery);
  }
@@ -570,8 +581,8 @@ public function testProcessSLORequestInvalidValid()
  $parsedQuery = getParamsFromUrl($targetUrl);
 
  $this->assertEmpty($this->_auth->getErrors());
- $sloUrl = $this->_settingsInfo['idp']['singleLogoutService']['url'];
- $this->assertContains($sloUrl, $targetUrl);
+ $sloResponseUrl = $this->_settingsInfo['idp']['singleLogoutService']['responseUrl'];
+ $this->assertContains($sloResponseUrl, $targetUrl);
  $this->assertArrayHasKey('SAMLResponse', $parsedQuery);
  $this->assertArrayNotHasKey('RelayState', $parsedQuery);
  }
@@ -636,8 +647,8 @@ public function testProcessSLORequestDeletingSession()
  $targetUrl = getUrlFromRedirect($trace);
  $parsedQuery = getParamsFromUrl($targetUrl);
 
- $sloUrl = $this->_settingsInfo['idp']['singleLogoutService']['url'];
- $this->assertContains($sloUrl, $targetUrl);
+ $sloResponseUrl = $this->_settingsInfo['idp']['singleLogoutService']['responseUrl'];
+ $this->assertContains($sloResponseUrl, $targetUrl);
  $this->assertArrayHasKey('SAMLResponse', $parsedQuery);
  $this->assertArrayNotHasKey('RelayState', $parsedQuery);
 
@@ -657,8 +668,8 @@ public function testProcessSLORequestDeletingSession()
  $targetUrl = getUrlFromRedirect($trace);
  $parsedQuery = getParamsFromUrl($targetUrl);
 
- $sloUrl = $this->_settingsInfo['idp']['singleLogoutService']['url'];
- $this->assertContains($sloUrl, $targetUrl);
+ $sloResponseUrl = $this->_settingsInfo['idp']['singleLogoutService']['responseUrl'];
+ $this->assertContains($sloResponseUrl, $targetUrl);
  $this->assertArrayHasKey('SAMLResponse', $parsedQuery);
  $this->assertArrayNotHasKey('RelayState', $parsedQuery);
 

tests/src/OneLogin/Saml2/IdPMetadataParserTest.php

@@ -21,6 +21,7 @@ public function testParseFileXML()
  ),
  'singleLogoutService' => array (
  'url' => 'https://example.onelogin.com/trust/saml2/http-redirect/slo/645460',
+ 'responseUrl' => '',
  'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
  ),
  'x509cert' => 'MIIEZTCCA02gAwIBAgIUPyy/A3bZAZ4m28PzEUUoT7RJhxIwDQYJKoZIhvcNAQEFBQAwcjELMAkGA1UEBhMCVVMxKzApBgNVBAoMIk9uZUxvZ2luIFRlc3QgKHNnYXJjaWEtdXMtcHJlcHJvZCkxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwWT25lTG9naW4gQWNjb3VudCA4OTE0NjAeFw0xNjA4MDQyMjI5MzdaFw0yMTA4MDUyMjI5MzdaMHIxCzAJBgNVBAYTAlVTMSswKQYDVQQKDCJPbmVMb2dpbiBUZXN0IChzZ2FyY2lhLXVzLXByZXByb2QpMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgODkxNDYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDN6iqQGcLOCglNO42I2rkzE05UXSiMXT6c8ALThMMiaDw6qqzo3sd/tKK+NcNKWLIIC8TozWVyh5ykUiVZps+08xil7VsTU7E+wKu3kvmOsvw2wlRwtnoKZJwYhnr+RkBa+h1r3ZYUgXm1ZPeHMKj1g18KaWz9+MxYL6BhKqrOzfW/P2xxVRcFH7/pq+ZsDdgNzD2GD+apzY4MZyZj/N6BpBWJ0GlFsmtBegpbX3LBitJuFkk5L4/U/jjF1AJa3boBdCUVfATqO5G03H4XS1GySjBIRQXmlUF52rLjg6xCgWJ30/+t1X+IHLJeixiQ0vxyh6C4/usCEt94cgD1r8ADAgMBAAGjgfIwge8wDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUPW0DcH0G3IwynWgi74co4wZ6n7gwga8GA1UdIwSBpzCBpIAUPW0DcH0G3IwynWgi74co4wZ6n7ihdqR0MHIxCzAJBgNVBAYTAlVTMSswKQYDVQQKDCJPbmVMb2dpbiBUZXN0IChzZ2FyY2lhLXVzLXByZXByb2QpMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgODkxNDaCFD8svwN22QGeJtvD8xFFKE+0SYcSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEAQhB4q9jrycwbHrDSoYR1X4LFFzvJ9Us75wQquRHXpdyS9D6HUBXMGI6ahPicXCQrfLgN8vzMIiqZqfySXXv/8/dxe/X4UsWLYKYJHDJmxXD5EmWTa65chjkeP1oJAc8f3CKCpcP2lOBTthbnk2fEVAeLHR4xNdQO0VvGXWO9BliYPpkYqUIBvlm+Fg9mF7AM/Uagq2503XXIE1Lq//HON68P10vNMwLSKOtYLsoTiCnuIKGJqG37MsZVjQ1ZPRcO+LSLkq0i91gFxrOrVCrgztX4JQi5XkvEsYZGIXXjwHqxTVyt3adZWQO0LPxPqRiUqUzyhDhLo/xXNrHCu4VbMw=='
@@ -70,6 +71,7 @@ public function testParseXML()
  ),
  'singleLogoutService' => array (
  'url' => 'https://idp.examle.com/saml/slo',
+ 'responseUrl' => 'https://idp.examle.com/saml/slr',
  'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
  ),
  'x509certMulti' => array (
@@ -180,6 +182,7 @@ public function testParseDesiredBindingAll()
  ),
  "singleLogoutService" => array(
  "url" => "http://idp.example.com/logout",
+ 'responseUrl' => '',
  "binding" => "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
  )
  )
@@ -297,6 +300,7 @@ public function testParseMultiCerts()
  "idp" => array(
  "singleLogoutService" => array(
  "url" => "https://idp.examle.com/saml/slo",
+ 'responseUrl' => '',
  "binding" => "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
  ),
  "x509certMulti" => array(
@@ -336,6 +340,7 @@ public function testParseMultiSigningCerts()
  "idp" => array(
  "singleLogoutService" => array(
  "url" => "https://idp.examle.com/saml/slo",
+ 'responseUrl' => '',
  "binding" => "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
  ),
  "x509certMulti" => array(
@@ -435,6 +440,7 @@ public function testInjectIntoSettings()
  ),
  'singleLogoutService' => array (
  'url' => 'https://idp.adfs.example.com/adfs/ls/',
+ 'responseUrl' => '',
  'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
  ),
  'x509certMulti' => array (

tests/src/OneLogin/Saml2/SettingsTest.php

@@ -333,6 +333,7 @@ public function testCheckSettings()
  $settingsInfo['idp']['entityID'] = 'entityId';
  $settingsInfo['idp']['singleSignOnService']['url'] = 'invalid_value';
  $settingsInfo['idp']['singleLogoutService']['url'] = 'invalid_value';
+ $settingsInfo['idp']['singleLogoutService']['responseUrl'] = 'invalid_value';
  $settingsInfo['sp']['assertionConsumerService']['url'] = 'invalid_value';
  $settingsInfo['sp']['singleLogoutService']['url'] = 'invalid_value';
  try {
@@ -341,6 +342,7 @@ public function testCheckSettings()
  } catch (OneLogin_Saml2_error $e) {
  $this->assertContains('idp_sso_url_invalid', $e->getMessage());
  $this->assertContains('idp_slo_url_invalid', $e->getMessage());
+ $this->assertContains('idp_slo_response_url_invalid', $e->getMessage());
  $this->assertContains('sp_acs_url_invalid', $e->getMessage());
  $this->assertContains('sp_sls_url_invalid', $e->getMessage());
  }