Skip to content

Add logoutRequestMatcher to Saml2LogoutConfigurer for custom matching #18122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+56 −0
Open

Add logoutRequestMatcher to Saml2LogoutConfigurer for custom matching #18122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions ...ringframework/security/config/annotation/web/configurers/saml2/Saml2LogoutConfigurer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,7 @@
*
* @author Josh Cummings
* @author Ngoc Nhan
* @author Andrey Litvitski
* @since 5.6
* @see Saml2LogoutConfigurer
*/
Expand All @@ -127,6 +128,8 @@ public final class Saml2LogoutConfigurer<H extends HttpSecurityBuilder<H>>

private LogoutResponseConfigurer logoutResponseConfigurer;

private RequestMatcher logoutRequestMatcher;

Comment on lines +131 to +132
Copy link
Contributor Author

@therepanic therepanic Nov 1, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess there is no better way than to carry the matcher in the class.

/**
* Creates a new instance
* @see HttpSecurity#logout(Customizer)
Expand Down Expand Up @@ -195,6 +198,16 @@ public Saml2LogoutConfigurer<H> logoutResponse(
return this;
}

/**
* Sets a custom {@link RequestMatcher} to use for SAML logout requests.
* @param logoutRequestMatcher the matcher to use
* @return the {@link Saml2LogoutConfigurer} for further customization
*/
public Saml2LogoutConfigurer<H> logoutRequestMatcher(RequestMatcher logoutRequestMatcher) {
this.logoutRequestMatcher = logoutRequestMatcher;
return this;
}

/**
* {@inheritDoc}
*/
Expand Down Expand Up @@ -271,6 +284,9 @@ private Saml2RelyingPartyInitiatedLogoutFilter createRelyingPartyLogoutFilter(
}

private RequestMatcher createLogoutMatcher() {
if (this.logoutRequestMatcher != null) {
return this.logoutRequestMatcher;
}
RequestMatcher logout = getRequestMatcherBuilder().matcher(HttpMethod.POST, this.logoutUrl);
RequestMatcher saml2 = new Saml2RequestMatcher(getSecurityContextHolderStrategy());
return new AndRequestMatcher(logout, saml2);
Expand Down
40 changes: 40 additions & 0 deletions ...ramework/security/config/annotation/web/configurers/saml2/Saml2LogoutConfigurerTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -543,6 +543,18 @@ public void saml2LogoutWhenLogoutFilterPostProcessedThenUses() {

}

// gh-10821
@Test
public void saml2LogoutWhenCustomLogoutRequestMatcherThenUsed() throws Exception {
this.spring.register(Saml2LogoutCustomMatcherConfig.class).autowire();
MvcResult result = this.mvc.perform(post("/saml/custom-logout").with(authentication(this.user)).with(csrf()))
.andExpect(status().isFound())
.andReturn();
assertThat(result.getResponse().getHeader("Location"))
.startsWith("https://ap.example.org/logout/saml2/request");
verify(getBean(LogoutHandler.class)).logout(any(), any(), any());
}

private <T> T getBean(Class<T> clazz) {
return this.spring.getContext().getBean(clazz);
}
Expand Down Expand Up @@ -577,6 +589,34 @@ LogoutHandler logoutHandler() {

}

@Configuration
@EnableWebSecurity
@Import(Saml2LoginConfigBeans.class)
static class Saml2LogoutCustomMatcherConfig {

LogoutHandler mockLogoutHandler = mock(LogoutHandler.class);

@Bean
SecurityFilterChain web(HttpSecurity http) throws Exception {
// @formatter:off
http
.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated())
.logout((logout) -> logout.addLogoutHandler(this.mockLogoutHandler))
.saml2Login(withDefaults())
.saml2Logout((saml2) -> saml2
.logoutRequestMatcher(pathPattern(HttpMethod.POST, "/saml/custom-logout"))
);
return http.build();
// @formatter:on
}

@Bean
LogoutHandler logoutHandler() {
return this.mockLogoutHandler;
}

}

@Configuration
@EnableWebSecurity
@Import(Saml2LoginConfigBeans.class)
Expand Down