omniauth-suomifi 0.6.3 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3145f5edab1c7f635c55c21d23eee97fba96657bf156076ec700261dc962e142
-  data.tar.gz: 0da243959e4f569866ec5bdcf97c686f2e08dfeacc6e38fbd514452f3cd0859e
+  metadata.gz: bc0704db48f42ecbc14c86e3e629e611b535b427cfd23ee9d0363545d12f0ee7
+  data.tar.gz: e895872a3b621fa5e7a3fe61b45156c8ce12b05abdc55b962dd2a3d4a5e7df8b
 SHA512:
-  metadata.gz: c7888c909cb1f4c55a6b89f788c8754242eac7d1f0b6bdcd58efc1e60827a0d824e50300b44226994e10d12afe2137ac27c5a338f1b7b671652b7d525110a0af
-  data.tar.gz: a8d854ea5d5bc6cb16ed5e78e3f93fd50eb25aa5b89539ebc0f8f22c4ec00c2b5efd3e6cfaf0ef3c543ca974c78693225609776a59a5551f20cd1d173c6a70de
+  metadata.gz: 4f4c2d1ffb1e80a120a832aae423ead500d3a725be94bbd776127c28892d02a70ab4f8748e0ff01a95fba14f8747b8742c63b33f49b35867add4970bbe812cba
+  data.tar.gz: 30dc8039e91aa1e6def01027596e47a060ef190fedcc68537b7c1ad0496a4e8d87efa38d2b03084744cc976adfa7e5353509814549dc95ebf3af2d5b61b8a663

data/lib/omniauth/strategies/suomifi.rb

@@ -529,7 +529,7 @@ module OmniAuth
         authn_request = OneLogin::RubySaml::Authrequest.new
         locale = locale_for_authn_request
 
-        session["saml_redirect_url"] = request.params["redirect_url"]
+        session['saml_redirect_url'] = request.params['redirect_url']
 
         with_settings do |settings|
           url = authn_request.create(settings, additional_params_for_authn_request)
@@ -562,6 +562,49 @@ module OmniAuth
 
     private
 
+      # The single log-out (SLO) in Suomi.fi is initiated in an iframe within
+      # the single logout page at Suomi.fi side. Therefore, due to browser
+      # restrictions, it is not possible to transfer session related data to the
+      # service from that page because it would require 3rd party cookies which
+      # are restricted by browsers.
+      #
+      # Therefore, the SLO request needs to be handled at the service's side by
+      # storing the Suomi.fi sessions in a database and then comparing the SAML
+      # uid of the SLO request to the values stored witin the database to log
+      # out the user who requested the logout. There is no other way to transfer
+      # this information from the
+      #
+      # The default functionality within the `omniauth-saml` strategy relies on
+      # the session variables to compare the SAML uid during the SLO request but
+      # this is not possible with Suomi.fi when the 3rd party cookies are
+      # prevented by the browser.
+      def handle_logout_request(raw_request, settings)
+        # If the "saml_uid" is set, the logout request was initiated by the
+        # application itself. If not, the code below calls the application which
+        # can do the validation against the database where the sessions are
+        # stored.
+        return super if session["saml_uid"]
+
+        # Otherwise, the application itself needs to handle the logout because
+        # this is not happening within the same session that the user has
+        # currently open at the website.
+        logout_request = OneLogin::RubySaml::SloLogoutrequest.new(
+          raw_request,
+          { settings: settings, get_params: @request.params }
+        )
+        raise OmniAuth::Strategies::SAML::ValidationError.new("SAML failed to process LogoutRequest") unless logout_request.is_valid?
+
+        @env['omniauth.saml_request'] = logout_request
+
+        # The SAML request needs to be validated at the application side and
+        # then the user needs to be redirected to the
+        logout_request_id = logout_request.id
+        logout_response = OneLogin::RubySaml::SloLogoutresponse.new.create(settings, logout_request_id, nil, RelayState: slo_relay_state)
+        @env['omniauth.saml_response'] = logout_response
+
+        call_app!
+      end
+
       # Suomi.fi requires that the service provider needs to end the local user
       # session BEFORE sending the logout request to the identity provider.
       def other_phase_for_spslo

data/lib/omniauth-suomifi/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module Suomifi
-    VERSION = '0.6.3'
+    VERSION = '0.7.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-suomifi
 version: !ruby/object:Gem::Version
-  version: 0.6.3
+  version: 0.7.0
 platform: ruby
 authors:
 - Antti Hukkanen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-02-06 00:00:00.000000000 Z
+date: 2024-02-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-saml