![]() |
![]() |
![]() |
Lasso Reference Manual | ![]() |
---|---|---|---|---|
Top | Description |
LassoLogout; LassoLogout* lasso_logout_new (LassoServer *server); LassoLogout* lasso_logout_new_from_dump (LassoServer *server, const gchar *dump); gint lasso_logout_build_request_msg (LassoLogout *logout); gint lasso_logout_build_response_msg (LassoLogout *logout); void lasso_logout_destroy (LassoLogout *logout); gchar* lasso_logout_dump (LassoLogout *logout); gchar* lasso_logout_get_next_providerID (LassoLogout *logout); gint lasso_logout_init_request (LassoLogout *logout, gchar *remote_providerID, LassoHttpMethod request_method); gint lasso_logout_process_request_msg (LassoLogout *logout, gchar *request_msg); gint lasso_logout_process_response_msg (LassoLogout *logout, gchar *response_msg); gint lasso_logout_reset_providerID_index (LassoLogout *logout); gint lasso_logout_validate_request (LassoLogout *logout);
This profile Send logout notifications between providers. Any receiving provider must retransmit the notification to any other providers with which it shares the current identity by any means supported by the two, that is any provider federated with the current provider. There can be partial failures if no binding can be found to notify a federating partner.
LassoLogout* lasso_logout_new (LassoServer *server);
Creates a new LassoLogout.
|
the LassoServer |
Returns : |
a newly created LassoLogout object; or NULL if an error occured |
LassoLogout* lasso_logout_new_from_dump (LassoServer *server, const gchar *dump);
Restores the dump
to a new LassoLogout.
|
the LassoServer |
|
XML logout dump |
Returns : |
a newly created LassoLogout; or NULL if an error occured |
gint lasso_logout_build_request_msg (LassoLogout *logout);
Builds the logout request message.
It gets the HTTP method retrieved to send the request and:
if it is a SOAP method, then it builds the logout request SOAP message,
sets the msg_body attribute, gets the single logout service url and sets
msg_url
in the logout object.
if it is a HTTP-Redirect method, then it builds the logout request QUERY
message, builds the logout request url, sets msg_url
in the logout
request url, sets msg_body
to NULL.
If private key and certificate are set in server object it will also signs the message (either with X509 if SOAP or with a simple signature for query strings).
|
a LassoLogout |
Returns : |
0 on success; or a negative value otherwise. |
gint lasso_logout_build_response_msg (LassoLogout *logout);
Builds the logout response message.
It gets the request message method and:
if it is a SOAP method, then it builds the logout response SOAP message,
sets the msg_body attribute, gets the single logout service return url
and sets msg_url
in the logout object.
if it is a HTTP-Redirect method, then it builds the logout response QUERY message,
builds the logout response url, sets msg_url
with the logout response url,
sets msg_body
to NULL
If private key and certificate are set in server object it will also signs the message (either with X509 if SOAP or with a simple signature for query strings).
|
a LassoLogout |
Returns : |
0 on success; or a negative value otherwise. |
void lasso_logout_destroy (LassoLogout *logout);
Destroys a logout object.
|
a LassoLogout |
gchar* lasso_logout_dump (LassoLogout *logout);
Dumps logout
content to an XML string.
|
a LassoLogout |
Returns : |
the dump string. It must be freed by the caller. |
gchar* lasso_logout_get_next_providerID (LassoLogout *logout);
Returns the provider id from providerID_index in list of providerIDs in principal session with the exception of initial service provider ID.
|
a LassoLogout |
Returns : |
a newly allocated string or NULL |
gint lasso_logout_init_request (LassoLogout *logout, gchar *remote_providerID, LassoHttpMethod request_method);
Initializes a new SLO request.
|
a LassoLogout |
|
the providerID of the identity provider. If NULL the first identity provider is used. |
|
if set, then it get the protocol profile in metadata corresponding of this HTTP request method. |
Returns : |
0 on success; or a negative value otherwise. |
gint lasso_logout_process_request_msg (LassoLogout *logout, gchar *request_msg);
Processes a SLO LogoutRequest message. Rebuilds a request object from the message and optionally verifies its signature.
|
a LassoLogout |
|
the logout request message |
Returns : |
0 on success; or a negative value otherwise. |
gint lasso_logout_process_response_msg (LassoLogout *logout, gchar *response_msg);
Parses the response message and builds the response object.
Checks the status code value and if it is not success, then if the local provider is a Service Provider and response method is SOAP, then builds a new logout request message for HTTP Redirect / GET method and returns the error code LASSO_LOGOUT_ERROR_UNSUPPORTED_PROFILE.
If it is a SOAP method or, IDP type and http method is Redirect/GET, then removes assertion.
If local server is an Identity Provider and if there is no more assertion (Identity Provider has logged out every Service Providers), then restores the initial response.
|
a LassoLogout |
|
the response message |
Returns : |
0 on success; or a negative value otherwise. |
gint lasso_logout_reset_providerID_index (LassoLogout *logout);
Reset the providerID_index attribute (set to 0).
|
a LassoLogout |
Returns : |
0 on success; or a negative value otherwise. |
gint lasso_logout_validate_request (LassoLogout *logout);
Sets the remote provider id
Sets a logout response with status code value to success.
Checks current signature status, if verification failed, stop processing and set the status code value to failure.
Verifies federation and authentication.
If the request http method is a SOAP method, then verifies every other Service Providers supports SOAP method : if not, then sets status code value to UnsupportedProfile and returns a code error with LASSO_LOGOUT_ERROR_UNSUPPORTED_PROFILE.
Every tests are ok, then removes assertion.
If local server is an Identity Provider and if there is more than one Service Provider (except the initial Service Provider), then saves the initial request, response and remote provider id.
|
a LassoLogout |
Returns : |
0 on success; or LASSO_PROFILE_ERROR_MISSING_REQUEST if no request has been found -- usually means that lasso_logout_process_request_msg was not called, LASSO_SERVER_ERROR_PROVIDER_NOT_FOUND if the requesting provider is not known to the server object, LASSO_PROFILE_ERROR_BUILDING_RESPONSE_FAILED if creation of the response object failed, LASSO_PROFILE_ERROR_NAME_IDENTIFIER_NOT_FOUND if the request do not contain a NameID element, LASSO_PROFILE_ERROR_SESSION_NOT_FOUND if the logout profile object do not contain a session object, LASSO_PROFILE_ERROR_MISSING_ASSERTION if no assertion from the requesting provider was found, LASSO_PROFILE_ERROR_IDENTITY_NOT_FOUND if the logout profile object do not contain an identity object, LASSO_PROFILE_ERROR_FEDERATION_NOT_FOUND if no federation for the requesting provider was found, LASSO_LOGOUT_ERROR_UNSUPPORTED_PROFILE if the requested HTTP method is not supported by all the remote provider of the current session. |