Add SingleLogoutService back to metadata builder (#51)

Release v0.17.0-18f

**Why:** Certain SAML clients use the SingleLogoutService elements in
the metadata to configure their logout behavior. This was originally
removed in #30 but it is unclear
why.

lib/saml_idp/configurator.rb

@@ -14,6 +14,7 @@ class Configurator
     attr_accessor :attribute_service_location
     attr_accessor :single_service_post_location
     attr_accessor :single_logout_service_post_location
+    attr_accessor :remote_logout_service_post_location
     attr_accessor :attributes
     attr_accessor :service_provider
     attr_accessor :pkcs11

lib/saml_idp/metadata_builder.rb

@@ -37,6 +37,14 @@ def fresh
                 Location: single_service_post_location
               descriptor.SingleSignOnService Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                 Location: single_service_post_location
+              descriptor.SingleLogoutService Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+                Location: single_logout_service_post_location
+              descriptor.SingleLogoutService Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+                Location: single_logout_service_post_location
+              if remote_logout_service_post_location.present?
+                descriptor.SingleLogoutService Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+                  Location: remote_logout_service_post_location
+              end
               build_attribute descriptor
             end
 
@@ -149,6 +157,7 @@ def raw_algorithm
       attribute_service_location
       single_service_post_location
       single_logout_service_post_location
+      remote_logout_service_post_location
       technical_contact
     ].each do |delegatable|
       define_method(delegatable) do

lib/saml_idp/version.rb

@@ -1,4 +1,4 @@
 # encoding: utf-8
 module SamlIdp
-  VERSION = '0.16.0-18f'.freeze
+  VERSION = '0.17.0-18f'.freeze
 end

spec/lib/saml_idp/configurator_spec.rb

@@ -11,6 +11,7 @@ module SamlIdp
     it { is_expected.to respond_to :attribute_service_location }
     it { is_expected.to respond_to :single_service_post_location }
     it { is_expected.to respond_to :single_logout_service_post_location }
+    it { is_expected.to respond_to :remote_logout_service_post_location }
     it { is_expected.to respond_to :name_id }
     it { is_expected.to respond_to :attributes }
     it { is_expected.to respond_to :service_provider }

spec/lib/saml_idp/metadata_builder_spec.rb

@@ -31,9 +31,23 @@ module SamlIdp
       expect(Saml::XML::Document.parse(subject.signed).valid_signature?(cloudhsm_idp_x509_cert_fingerprint)).to be_truthy
     end
 
-    it "includes logout element" do
+    it "includes logout elements" do
       subject.configurator.single_logout_service_post_location = 'https://example.com/saml/logout'
-      expect(subject.fresh).not_to include('SingleLogoutService')
+      subject.configurator.remote_logout_service_post_location = 'https://example.com/saml/remote_logout'
+      expect(subject.fresh.scan(/SingleLogoutService/).count).to eq(3)
+      expect(subject.fresh).to match(slo_regex('HTTP-POST', 'https://example.com/saml/logout'))
+      expect(subject.fresh).to match(slo_regex('HTTP-Redirect', 'https://example.com/saml/logout'))
+      expect(subject.fresh).to match(slo_regex('HTTP-POST', 'https://example.com/saml/remote_logout'))
+    end
+
+    it "skips remote logout if not present" do
+      subject.configurator.single_logout_service_post_location = 'https://example.com/saml/logout'
+      subject.configurator.remote_logout_service_post_location = nil
+      expect(subject.fresh.scan(/SingleLogoutService/).count).to eq(2)
+    end
+
+    def slo_regex(binding, location)
+      %r{<SingleLogoutService Binding=.+#{binding}.+ Location=.+#{location}.+/>}
     end
   end
 end