Hello Pedro,

Thanks for your participation !

I found the way how PicketLink determines logout page for SP. It can be configured using metadata file.

During initialization phase PicketLink parses all SP's metadata and put it into spSSOMetadataMap variable :

public abstract class AbstractIDPValve extends ValveBase  {

protected void initIDPConfiguration() {

.....

            // Read SP Metadata if provided

            List<EntityDescriptorType> entityDescriptors = CoreConfigUtil.getMetadataConfiguration(idpConfiguration,

                getContext().getServletContext());

            if (entityDescriptors != null) {

                for (EntityDescriptorType entityDescriptorType : entityDescriptors) {

                    SPSSODescriptorType spSSODescriptor = CoreConfigUtil.getSPDescriptor(entityDescriptorType);

                    if (spSSODescriptor != null) {

                        spSSOMetadataMap.put(entityDescriptorType.getEntityID(), spSSODescriptor);

                    }

                }

            }

}

}

After that this SP metadata is used when SP initiates Single Sign On. The PicketLink idP creates session for the participant with SP logout page information. This information is used by idP for SLO phase.It is OK.

To use it you need to define metadata provider element inside PicketLinkIDP configuration :

<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">

<PicketLinkIDP xmlns="urn:picketlink:identity-federation:config:2.1" SupportsSignatures="true" EnableAudit="true">

          .................

         <MetaDataProvider ClassName="org.picketlink.identity.federation.core.saml.md.providers.FileBasedEntitiesMetadataProvider">

           <Option Key="FileName" Value="/WEB-INF/classes/idp-metadata.xml"/>

        </MetaDataProvider>

</PicketLinkIDP>

....

</PicketLink>

The reason why it didn't work before it is because I configured metadata configuration provider using param for valve in jboss-web.xml.xml :

<valve>

        <class-name>org.picketlink.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve</class-name>    

        <param>

            <param-name>configProvider</param-name>        

            <param-value>com.mbocorp.idp.picketlink.config.CustomIDPMetadataConfigurationProvider</param-value>

        </param>

          ......................

    </valve>

In this case entity descriptors list in the code snippet below  (from initialization phase described above) :

List<EntityDescriptorType> entityDescriptors = CoreConfigUtil.getMetadataConfiguration(idpConfiguration,

                getContext().getServletContext());

returns null.

It seems to me that this is not correct implementation of IDPMetadataConfigurationProvider -> getIDPConfiguration() method.

From my point of view it should set correct metadata provider type for created IDPType. Something like that :

public IDPType getIDPConfiguration() throws ProcessingException {

        IDPType idpType = null;

        try {

            EntitiesDescriptorType entities = parseMDFile();

            if(entities == null){

                throw logger.nullValueError("entities");

            }

            IDPSSODescriptorType idpSSO = CoreConfigUtil.getIDPDescriptor(entities);

            if (idpSSO != null) {

                idpType = CoreConfigUtil.getIDPType(idpSSO);

            }

            configureTrustedDomainsFromMetadata(idpType, entities);

        } catch (ParsingException e) {

            throw logger.processingError(e);

        }

        if (configParsedIDPType != null) {

            idpType.importFrom(configParsedIDPType);

        }

         // Define correct metadata provider type

        MetadataProviderType metadataProviderType = new MetadataProviderType();

        KeyValueType keyValueType = new KeyValueType();

        keyValueType.setKey("FileName");

        keyValueType.setValue($metaDataPath);

        metadataProviderType.add(keyValueType);

        metadataProviderType.setClassName(FileBasedEntitiesMetadataProvider.class.getName());

        idpType.setMetaDataProvider(metadataProviderType);

        return idpType;

    }

Any Idea related to this point ?

Another point I want to discuss it is how to separate picket link configuration files from application.

PL makes me put configuration files into WAR application  because it use servletContext.getResourceAsStream.

I can not correct way to solve it except patch PL source code