Device authorization logout

OpenConext · Aug 20, 2024 · 9955322 · 9955322
1 parent 16c2985
commit 9955322
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 12 deletions.
diff --git a/src/main/java/oidc/endpoints/AuthorizationEndpoint.java b/src/main/java/oidc/endpoints/AuthorizationEndpoint.java
@@ -248,15 +248,6 @@ private static String adStateToQueryParameters(UriComponentsBuilder builder, Sta
         return uriString;
     }
 
-    private void logout(HttpServletRequest request) {
-        SecurityContextHolder.getContext().setAuthentication(null);
-        SecurityContextHolder.clearContext();
-        HttpSession session = request.getSession(false);
-        if (session != null) {
-            session.invalidate();
-        }
-    }
-
     private ModelAndView doConsent(MultiValueMap<String, String> parameters,
                                    OpenIDClient client,
                                    Set<String> scopes,

diff --git a/src/main/java/oidc/endpoints/DeviceAuthorizationEndpoint.java b/src/main/java/oidc/endpoints/DeviceAuthorizationEndpoint.java
@@ -45,7 +45,7 @@
 import static oidc.endpoints.AuthorizationEndpoint.validateScopes;
 
 @RestController
-public class DeviceAuthorizationEndpoint {
+public class DeviceAuthorizationEndpoint implements OidcEndpoint{
 
     private static final Log LOG = LogFactory.getLog(DeviceAuthorizationEndpoint.class);
 
@@ -161,8 +161,11 @@ public ModelAndView postVerify(@RequestParam Map<String, String> body, HttpServl
         ModelAndView modelAndView = findByUserCode(userCode)
                 //avoid replay's
                 .filter(deviceAuthorization -> deviceAuthorization.getStatus().equals(DeviceAuthorizationStatus.authorization_pending))
-                .map(deviceAuthorization ->
-                        new ModelAndView(new RedirectView(deviceAuthorizeURL(deviceAuthorization), true)))
+                .map(deviceAuthorization -> {
+                    //We do not provide SSO as does EB not - up to the identity provider
+                    logout(request);
+                    return new ModelAndView(new RedirectView(deviceAuthorizeURL(deviceAuthorization), true));
+                })
                 .orElseGet(() -> this.verification(null, "true", request));
         return modelAndView;
     }

diff --git a/src/main/java/oidc/endpoints/OidcEndpoint.java b/src/main/java/oidc/endpoints/OidcEndpoint.java
@@ -4,7 +4,10 @@
 import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
 import com.nimbusds.openid.connect.sdk.ClaimsRequest;
 import oidc.model.OpenIDClient;
+import org.springframework.security.core.context.SecurityContextHolder;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
 import java.time.LocalDateTime;
 import java.time.ZoneId;
 import java.util.ArrayList;
@@ -50,4 +53,14 @@ default Date tokenValidity(int validity) {
         LocalDateTime ldt = LocalDateTime.now().plusSeconds(validity);
         return Date.from(ldt.atZone(ZoneId.systemDefault()).toInstant());
     }
+    default void logout(HttpServletRequest request) {
+        SecurityContextHolder.getContext().setAuthentication(null);
+        SecurityContextHolder.clearContext();
+        HttpSession session = request.getSession(false);
+        if (session != null) {
+            session.invalidate();
+        }
+    }
+
+
 }
diff --git a/src/main/java/oidc/endpoints/TokenEndpoint.java b/src/main/java/oidc/endpoints/TokenEndpoint.java
@@ -293,6 +293,7 @@ private ResponseEntity handleDeviceCodeFlow(DeviceAuthorization deviceAuthorizat
         //We only permit one request for a success authorization
         LOG.debug(String.format("Deleting deviceAuthorization as token is returned for client %s", client.getName()));
         deviceAuthorizationRepository.delete(deviceAuthorization);
+
         return new ResponseEntity<>(body, responseHttpHeaders, HttpStatus.OK);
 
     }