[FEDIZ-220] http 400 when logout with redirect to constraint

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.3
• Fix Version/s: 1.4.5
• Component/s: Plugin
• Assignee: Colm O hEigeartaigh
• Reporter: Arnaud MERGEY
• Created: 03/Jul/18 16:55
• Updated: 09/Oct/18 11:56
• Resolved: 04/Jul/18 10:51

Description

I would like to redirect to a page after logout from a SAML authentication with tomcat plugin.

I have added this in my fediz_config.xml 

 

<logoutRedirectToConstraint type="String">.*logout.do.*</logoutRedirectToConstraint>

 

Then when I logout, instead of being redirected as expected I have an http 400 because the redirec url (/mycontext/logout.do?display=2) is  url encoded and becomes not valid (because of / and ?).

I looked in the code and it seems to me the issue is here 

org.apache.cxf.fediz.core.handler.LogoutHandler.signoutCleanup(HttpServletRequest request, HttpServletResponse response) 

line 114 

response.sendRedirect(URLEncoder.encode(wreply, "UTF-8"));

should be replaced with

response.sendRedirect(response.encodeRedirectURL(wreply);