I can't log out using a custom url in OKTA SAML 2.0.

Greenhorn

Posts: 4

posted 1 month ago

Number of slices to send:

Optional 'thank-you' note:

Send

I am using Okta for single sign-in processes with Spring Boot and Java 1.8.

But the problem is that when I use any custom logout URL, I get a Whitelabel Error Page.

SamlConfig.java

@Configuration
@EnableWebSecurity
@Order(1)
public class SamlConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private RelyingPartyRegistrationRepository relyingPartyRegistrationRepository;

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests(authorize ->
                        authorize.antMatchers("/").permitAll().anyRequest().authenticated()
                )
                .saml2Login()
                .and()
                .logout().logoutUrl("/test")
                .permitAll()
                .invalidateHttpSession(true)
                .deleteCookies("JSESSIONID");

// add auto-generation of ServiceProvider Metadata
        Converter<HttpServletRequest, RelyingPartyRegistration> relyingPartyRegistrationResolver =
                new DefaultRelyingPartyRegistrationResolver(relyingPartyRegistrationRepository);
        Saml2MetadataFilter filter =
                new Saml2MetadataFilter(relyingPartyRegistrationResolver, new OpenSamlMetadataResolver());
        http.addFilterBefore(filter, Saml2WebSsoAuthenticationFilter.class);
    }

@Bean
    RelyingPartyRegistrationRepository relyingPartyRegistrations() throws Exception {
        ClassLoader classLoader = getClass().getClassLoader();
        File verificationCert = new File(classLoader.getResource("local.crt").getFile());
        X509Certificate certificate = X509Support.decodeCertificate(verificationCert);

PrivateKeyLoader privateKeyLoader = new PrivateKeyLoader();

PrivateKey privateKey = privateKeyLoader.load("local.key");

Saml2X509Credential credential = Saml2X509Credential.signing(privateKey, certificate);

RelyingPartyRegistration registration = RelyingPartyRegistrations
                .fromMetadataLocation("https://xyz.okta.com/app/dsfsvxavd4445yrbef/sso/saml/metadata")
                .registrationId("okta")
                .singleLogoutServiceLocation("http://localhost:8086/logout/saml2/slo")
                .signingX509Credentials((signing) -> signing.add(credential))
                .build();
        return new InMemoryRelyingPartyRegistrationRepository(registration);
    }
}

AuthController.java

package com.example.demo.controller;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Controller
public class AuthController {

@RequestMapping("/home")
    public String home(@AuthenticationPrincipal Saml2AuthenticatedPrincipal principal, Model model) {
        model.addAttribute("name", principal.getName());
        model.addAttribute("emailAddress", principal.getFirstAttribute("email"));
        model.addAttribute("userAttributes", principal.getAttributes());

return "home";
    }

@RequestMapping(value = "/test", method = RequestMethod.GET)
    public String logout(HttpServletRequest request, HttpServletResponse response) {
        return "redirect:/saml/logout";
    }

}

getting below error

error.PNG

Tim Holloway

Saloon Keeper

Posts: 27851

196

I like...

posted 1 month ago

1
Number of slices to send:

Optional 'thank-you' note:

Send

Check your console/logs. Spring Boot routes to "/error" if an error occurs in application code - either something you wrote, or something that annoyed the Spring Boot support code. So the problem isn't that you went to "error", it's that you had an error.

The secret of how to be miserable is to constantly expect things are going to happen the way that they are "supposed" to happen.

You can have faith, which carries the understanding that you may be disappointed. Then there's being a willfully-blind idiot, which virtually guarantees it.

With a little knowledge, a cast iron skillet is non-stick and lasts a lifetime.