omniauth-suomifi 0.6.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 06c8999872e4f947d69c4c942bd507052fe99a3187b1eb9431fc5bed85e39402
-  data.tar.gz: 03e36ad409d752a71d4b1b1edb5c5398856c2d0b82d98c8bb92c77ed4582f3c8
+  metadata.gz: bc0704db48f42ecbc14c86e3e629e611b535b427cfd23ee9d0363545d12f0ee7
+  data.tar.gz: e895872a3b621fa5e7a3fe61b45156c8ce12b05abdc55b962dd2a3d4a5e7df8b
 SHA512:
-  metadata.gz: df2caddab2c1592e824f1fb338f864349c8a6309b1999f664764afb46d16dc13f44a6b96048ded76020bcdeabcb583c3c468a60af0ccc8d4e3eebf2023f969a0
-  data.tar.gz: 579b0c5e580f757fefe744537aa73e69ba4f89a5f3bb72f1bcab408834940586f9d54d58f78fbd9c9e2a89a8478cfe7ad3be3c24354c561c5ceeb52090cf8cfb
+  metadata.gz: 4f4c2d1ffb1e80a120a832aae423ead500d3a725be94bbd776127c28892d02a70ab4f8748e0ff01a95fba14f8747b8742c63b33f49b35867add4970bbe812cba
+  data.tar.gz: 30dc8039e91aa1e6def01027596e47a060ef190fedcc68537b7c1ad0496a4e8d87efa38d2b03084744cc976adfa7e5353509814549dc95ebf3af2d5b61b8a663

data/lib/omniauth/strategies/suomifi.rb

@@ -529,6 +529,8 @@ module OmniAuth
         authn_request = OneLogin::RubySaml::Authrequest.new
         locale = locale_for_authn_request
 
+        session['saml_redirect_url'] = request.params['redirect_url']
+
         with_settings do |settings|
           url = authn_request.create(settings, additional_params_for_authn_request)
           url += "&locale=#{CGI.escape(locale)}" unless locale.nil?
@@ -560,6 +562,49 @@ module OmniAuth
 
     private
 
+      # The single log-out (SLO) in Suomi.fi is initiated in an iframe within
+      # the single logout page at Suomi.fi side. Therefore, due to browser
+      # restrictions, it is not possible to transfer session related data to the
+      # service from that page because it would require 3rd party cookies which
+      # are restricted by browsers.
+      #
+      # Therefore, the SLO request needs to be handled at the service's side by
+      # storing the Suomi.fi sessions in a database and then comparing the SAML
+      # uid of the SLO request to the values stored witin the database to log
+      # out the user who requested the logout. There is no other way to transfer
+      # this information from the
+      #
+      # The default functionality within the `omniauth-saml` strategy relies on
+      # the session variables to compare the SAML uid during the SLO request but
+      # this is not possible with Suomi.fi when the 3rd party cookies are
+      # prevented by the browser.
+      def handle_logout_request(raw_request, settings)
+        # If the "saml_uid" is set, the logout request was initiated by the
+        # application itself. If not, the code below calls the application which
+        # can do the validation against the database where the sessions are
+        # stored.
+        return super if session["saml_uid"]
+
+        # Otherwise, the application itself needs to handle the logout because
+        # this is not happening within the same session that the user has
+        # currently open at the website.
+        logout_request = OneLogin::RubySaml::SloLogoutrequest.new(
+          raw_request,
+          { settings: settings, get_params: @request.params }
+        )
+        raise OmniAuth::Strategies::SAML::ValidationError.new("SAML failed to process LogoutRequest") unless logout_request.is_valid?
+
+        @env['omniauth.saml_request'] = logout_request
+
+        # The SAML request needs to be validated at the application side and
+        # then the user needs to be redirected to the
+        logout_request_id = logout_request.id
+        logout_response = OneLogin::RubySaml::SloLogoutresponse.new.create(settings, logout_request_id, nil, RelayState: slo_relay_state)
+        @env['omniauth.saml_response'] = logout_response
+
+        call_app!
+      end
+
       # Suomi.fi requires that the service provider needs to end the local user
       # session BEFORE sending the logout request to the identity provider.
       def other_phase_for_spslo

data/lib/omniauth-suomifi/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module Suomifi
-    VERSION = '0.6.2'
+    VERSION = '0.7.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-suomifi
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Antti Hukkanen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-01-23 00:00:00.000000000 Z
+date: 2024-02-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-saml