Ignoring the sessionDataKey parameter value in commonAuthLogout requests.
@@ -98,8 +98,12 @@ public class DefaultRequestCoordinator implements RequestCoordinator {
// the request type (e.g. samlsso) set by the calling servlet.
// TODO: use a different mechanism to determine the flow start.
if (request.getParameter("type") != null) {
- // Retrieve AuthenticationRequestCache Entry which is stored stored from servlet.
+ // If the request is not a common auth logout request retrieve AuthenticationRequestCache entry,
+ // which is stored stored from servlet against the session data key.
+ if (!isCommonAuthLogoutRequest(request)) {
+
if (sessionDataKey != null) {
+
if (log.isDebugEnabled()) {
log.debug("retrieving authentication request from cache..");
}
@@ -108,18 +112,17 @@ public class DefaultRequestCoordinator implements RequestCoordinator {
if (authRequest == null) {
// authRequest cannot be retrieved from cache. Cache
- throw new FrameworkException("Invalid authentication request. Session data key : " + sessionDataKey);
+ throw new FrameworkException("Invalid authentication request. Session data key : "
+ + sessionDataKey);
}
-
- } else if (!Boolean.parseBoolean(request.getParameter(FrameworkConstants.LOGOUT))) {
-
+ } else {
// sessionDataKey is null and not a logout request
if (log.isDebugEnabled()) {
log.debug("Session data key is null in the request and not a logout request.");
}
-
FrameworkUtils.sendToRetryPage(request, response);
}
+ }
// if there is a cache entry, wrap the original request with params in cache entry
if (authRequest != null) {
@@ -178,6 +181,16 @@ public class DefaultRequestCoordinator implements RequestCoordinator {
}
}
+ /**
+ * Returns true if the request is a CommonAuth logout request.
+ * @param request
+ * @return
+ */
+ private boolean isCommonAuthLogoutRequest(HttpServletRequest request) {
+
+ return Boolean.parseBoolean(request.getParameter(FrameworkConstants.LOGOUT));
+ }
+
/**
* When cache removed authentication request stored as request attribute, then taking request from request or
* otherwise getting authentication request from cache
