Skip to content

SAML 2.0 Logout filters should consider RelyingPartyRegistration logout properties #11182

Open
@marcusdacoregio

Description

@marcusdacoregio

Describe the bug
Each RelyingParty can specify its own logout URL properties, but doing that results in having to change the RequestMatcher used by Saml2LogoutRequest/ResponseFilter manually to match those different URLs. It could be confusing to allow multiple relying parties to be defined with different locations that ultimately have no effect (or an undefined effect) on the behavior.

In both the logout request and logout response filters, the payload validation is going to check the URI against the registration's configured URI anyway. With that said, we should resolve the RequestMatcher based on what's in the RelyingPartyRegistration.

Expected behavior
Saml2LogoutRequestFilter and Saml2LogoutResponseFilter should consider singleLogoutServiceLocation and singleLogoutServiceResponseLocation in the RequestMatcher.

Related:

Metadata

Metadata

Assignees

No one assigned

    Labels

    in: saml2An issue in SAML2 modulestype: bugA general bug

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions