refactor Single Sign-On authentication consents evaluator to get executed by processEngine

1 files changed, 269 insertions, 281 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
index 4131e49fc..7863c684e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
@@ -23,7 +23,6 @@
 package at.gv.egovernment.moa.id.moduls;
 
 import java.io.IOException;
-import java.io.PrintWriter;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Enumeration;
@@ -53,6 +52,7 @@ import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionExtensions;
 import at.gv.egovernment.moa.id.auth.exception.InvalidProtocolRequestException;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.auth.modules.SingleSignOnConsentsModuleImpl;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
 import at.gv.egovernment.moa.id.auth.modules.registration.ModuleRegistration;
 import at.gv.egovernment.moa.id.commons.db.dao.session.InterfederationSessionStore;
@@ -101,52 +101,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 	public AuthenticationManager() {
 		
 	}
-		
-	/**
-	 * Checks if a authenticated MOASession already exists and if {protocolRequest} is authenticated
-	 * 
-	 * @param protocolRequest Authentication request which is actually in process
-	 * @param moaSession MOASession with authentication information or null if no MOASession exists
-	 * 
-	 * @return true if session is already authenticated, otherwise false
-	 * @throws MOAIDException 
-	 */
-	private boolean tryPerformAuthentication(RequestImpl protocolRequest, AuthenticationSession moaSession) {
-
-		//if no MOASession exist -> authentication is required
-		if (moaSession == null) {
-			return false;
 			
-		} else {
-			//if MOASession is Found but not authenticated --> authentication is required
-			if (!moaSession.isAuthenticated()) {
-				return false;
-			}
-			
-			//if MOASession is already authenticated and protocol-request is authenticated 
-			//  --> no authentication is required any more
-			else if (moaSession.isAuthenticated() && protocolRequest.isAuthenticated()) {
-				return true;
-
-			// if MOASession is authenticated and SSO is allowed --> authenticate pendingRequest
-			} else if (!protocolRequest.isAuthenticated() 
-					&& moaSession.isAuthenticated() && protocolRequest.needSingleSignOnFunctionality()) {
-				Logger.debug("Found active MOASession and SSO is allowed --> pendingRequest is authenticted");
-				protocolRequest.setAuthenticated(true);
-				protocolRequest.setMOASessionIdentifier(moaSession.getSessionID());
-				return true;
-				
-			}
-			
-			// force authentication as backup solution
-			else {
-				Logger.warn("Authentication-required check find an unsuspected state --> force authentication");
-				return false;
-				
-			}					
-		}
-	}
-	
 	public void performSingleLogOut(HttpServletRequest httpReq,
 	HttpServletResponse httpResp, AuthenticationSession session, PVPTargetConfiguration pvpReq) throws MOAIDException {
 		performSingleLogOut(httpReq, httpResp, session, pvpReq, null);
@@ -159,163 +114,6 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 		
 	}
 	
-	
-	private void performSingleLogOut(HttpServletRequest httpReq,
-	HttpServletResponse httpResp, AuthenticationSession session, PVPTargetConfiguration pvpReq, String authURL) throws MOAIDException {		
-		String pvpSLOIssuer = null;
-		String inboundRelayState = null;
-		
-		if (pvpReq != null) {
-			MOARequest samlReq = (MOARequest) pvpReq.getRequest();
-			LogoutRequest logOutReq = (LogoutRequest) samlReq.getSamlRequest();
-			pvpSLOIssuer = logOutReq.getIssuer().getValue();
-			inboundRelayState = samlReq.getRelayState();
-			
-		}
-		
-		//store active OAs to SLOContaine
-		List<OASessionStore> dbOAs = authenticatedSessionStore.getAllActiveOAFromMOASession(session);
-		List<InterfederationSessionStore> dbIDPs = authenticatedSessionStore.getAllActiveIDPsFromMOASession(session);
-		SLOInformationContainer sloContainer = new SLOInformationContainer();
-		sloContainer.setSloRequest(pvpReq);
-		sloContainer.parseActiveIDPs(dbIDPs, pvpSLOIssuer);
-		sloContainer.parseActiveOAs(dbOAs, pvpSLOIssuer);
-						
-		//terminate MOASession
-		try {
-			authenticatedSessionStore.destroySession(session.getSessionID());
-			ssoManager.deleteSSOSessionID(httpReq, httpResp);
-			
-		} catch (MOADatabaseException e) {
-			Logger.warn("Delete MOASession FAILED.");
-			sloContainer.putFailedOA(pvpReq.getAuthURL());
-			
-		}
-		
-		//start service provider back channel logout process
-		Iterator<String> nextOAInterator = sloContainer.getNextBackChannelOA();	
-		while (nextOAInterator.hasNext()) {
-			SLOInformationImpl sloDescr = sloContainer.getBackChannelOASessionDescripten(nextOAInterator.next());
-			LogoutRequest sloReq = SingleLogOutBuilder.buildSLORequestMessage(sloDescr);
-
-			try {
-				List<XMLObject> soapResp = MOASAMLSOAPClient.send(sloDescr.getServiceURL(), sloReq);
-				
-				LogoutResponse sloResp = null;						
-				for (XMLObject el : soapResp) {
-					if (el instanceof LogoutResponse)
-						sloResp = (LogoutResponse) el;							
-				}
-				
-				if (sloResp == null) {
-					Logger.warn("Single LogOut for OA " + sloReq.getIssuer().getValue()
-							+ " FAILED. NO LogOut response received.");
-					sloContainer.putFailedOA(sloReq.getIssuer().getValue());
-					
-				} else {
-					SAMLVerificationEngine engine = new SAMLVerificationEngine();
-					engine.verifySLOResponse(sloResp, 
-							TrustEngineFactory.getSignatureKnownKeysTrustEngine());
-					
-				}
-								
-				SingleLogOutBuilder.checkStatusCode(sloContainer, sloResp);
-										
-			} catch (SOAPException e) {
-				Logger.warn("Single LogOut for OA " + sloReq.getIssuer().getValue()
-						+ " FAILED.", e);
-				sloContainer.putFailedOA(sloReq.getIssuer().getValue());
-				
-			} catch (SecurityException | InvalidProtocolRequestException e) {
-				Logger.warn("Single LogOut for OA " + sloReq.getIssuer().getValue()
-						+ " FAILED.", e);
-				sloContainer.putFailedOA(sloReq.getIssuer().getValue());
-				
-			}					
-		}
-						
-		//start service provider front channel logout process
-		try {
-			if (sloContainer.hasFrontChannelOA()) {
-				String relayState = Random.nextRandom();
-				
-				Collection<Entry<String, SLOInformationImpl>> sloDescr = sloContainer.getFrontChannelOASessionDescriptions();
-				List<String> sloReqList = new ArrayList<String>();
-				for (Entry<String, SLOInformationImpl> el : sloDescr) {
-					LogoutRequest sloReq = SingleLogOutBuilder.buildSLORequestMessage(el.getValue());
-					try {
-						sloReqList.add(SingleLogOutBuilder.getFrontChannelSLOMessageURL(el.getValue().getServiceURL(), el.getValue().getBinding(), 
-								sloReq, httpReq, httpResp, relayState));
-						
-					} catch (Exception e) {
-						Logger.warn("Failed to build SLO request for OA:" + el.getKey());
-						sloContainer.putFailedOA(el.getKey());
-						
-					}														
-				}
-				
-				//put SLO process-information into transaction storage
-				transactionStorage.put(relayState, sloContainer);
-				
-				if (MiscUtil.isEmpty(authURL))
-					authURL = pvpReq.getAuthURL();
-				
-				String timeOutURL = authURL
-						+ "/idpSingleLogout"
-						+ "?restart=" + relayState;
-				
-		        VelocityContext context = new VelocityContext();
-		        context.put("redirectURLs", sloReqList);
-		        context.put("timeoutURL", timeOutURL);
-		        context.put("timeout", SLOTIMEOUT);
-		        ssoManager.printSingleLogOutInfo(context, httpResp);
-				
-								
-			} else {
-				if (pvpReq != null) {
-					//send SLO response to SLO request issuer
-					SingleLogoutService sloService = SingleLogOutBuilder.getResponseSLODescriptor(pvpReq);
-					LogoutResponse message = SingleLogOutBuilder.buildSLOResponseMessage(sloService, pvpReq, sloContainer.getSloFailedOAs());
-					SingleLogOutBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState);
-					
-				} else {
-					//print SLO information directly
-			        VelocityContext context = new VelocityContext();
-			        if (sloContainer.getSloFailedOAs() == null || 
-			        		sloContainer.getSloFailedOAs().size() == 0)
-			        	context.put("successMsg", 
-			        			MOAIDMessageProvider.getInstance().getMessage("slo.00", null));
-			        else
-			        	context.put("errorMsg", 
-			        			MOAIDMessageProvider.getInstance().getMessage("slo.01", null));
-			        ssoManager.printSingleLogOutInfo(context, httpResp);
-										
-				}
-									
-			}	
-								
-		} catch (MOADatabaseException e) {
-			Logger.error("MOA AssertionDatabase ERROR", e);
-			if (pvpReq != null) {
-				SingleLogoutService sloService = SingleLogOutBuilder.getResponseSLODescriptor(pvpReq);
-				LogoutResponse message = SingleLogOutBuilder.buildSLOErrorResponse(sloService, pvpReq, StatusCode.RESPONDER_URI);
-				SingleLogOutBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState);
-				
-			}else {
-				//print SLO information directly
-		        VelocityContext context = new VelocityContext();
-	        	context.put("errorMsg", 
-	        			MOAIDMessageProvider.getInstance().getMessage("slo.01", null));
-		        ssoManager.printSingleLogOutInfo(context, httpResp);
-									
-			}
-			
-		} catch (Exception e) {
-			// TODO Auto-generated catch block
-			e.printStackTrace();
-		}				
-	}
-		
 	public void performOnlyIDPLogOut(HttpServletRequest request,
 			HttpServletResponse response, String moaSessionID) {
 		Logger.info("Logout");
@@ -387,7 +185,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 		//check if interfederation IDP is requested
 		ssoManager.checkInterfederationIsRequested(httpReq, httpResp, pendingReq);
 		
-		//check SSO session
+		//check if SSO session cookie is already used
 		if (ssoId != null) {
 			String correspondingMOASession = ssoManager.existsOldSSOSession(ssoId);
 			
@@ -402,21 +200,22 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 				ssoManager.deleteSSOSessionID(httpReq, httpResp);
 			}
 		}
-				
+
+		//check if SSO Session is valid
+		boolean isValidSSOSession = ssoManager.isValidSSOSession(ssoId, pendingReq);
+		
 		// check if Service-Provider allows SSO sessions
 		IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
-		boolean useSSOOA = oaParam.useSSO() || oaParam.isInderfederationIDP();
+		boolean useSSOOA = oaParam.useSSO() || oaParam.isInderfederationIDP();		
 		
 		revisionsLogger.logEvent(oaParam, 
 				pendingReq, MOAIDEventConstants.AUTHPROCESS_SERVICEPROVIDER, pendingReq.getOAURL());
 		
 		//if a legacy request is used SSO should not be allowed in case of mandate authentication
 		boolean isUseMandateRequested = LegacyHelper.isUseMandateRequested(httpReq);
-	
-		//check if SSO Session is valid
-		boolean isValidSSOSession = ssoManager.isValidSSOSession(ssoId, pendingReq);
-		
+			
 		//check if SSO is allowed for the actually executed request
+		//INFO: Actually, useMandate disables SSO functionality!!!!!
 		boolean isSSOAllowed = (useSSOOA  && !isUseMandateRequested);
 		pendingReq.setNeedSingleSignOnFunctionality(isSSOAllowed);
 						
@@ -428,6 +227,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 			
 			if (moaSession == null)
 				Logger.info("No MOASession FOUND with provided SSO-Cookie.");
+			
 			else {
 				Logger.debug("Found authenticated MOASession with provided SSO-Cookie.");
 				revisionsLogger.logEvent(oaParam, pendingReq, MOAIDEventConstants.AUTHPROCESS_SSO);
@@ -436,25 +236,22 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 		}
 						
 		//check if session is already authenticated
-		boolean tryperform = tryPerformAuthentication((RequestImpl) pendingReq, moaSession);
-		
-		//perfom SSO-Consents question if it it required
-		if (tryperform && isSSOAllowed && oaParam.useSSOQuestion()) {			
-			sendTransmitAssertionQuestion(httpReq, httpResp, pendingReq, oaParam);
-			return null;
-			
-		}
-		
+		boolean isSessionAuthenticated = tryPerformAuthentication((RequestImpl) pendingReq, moaSession);
+				
 		//force new authentication authentication process
 		if (pendingReq.forceAuth()) {	
 			startAuthenticationProcess(httpReq, httpResp, pendingReq);
 			return null;
-							
+				
+		//perform SSO-Consents evaluation if it it required			
+		} else if (isSessionAuthenticated && oaParam.useSSOQuestion()) {
+			sendSingleSignOnConsentsEvaluation(httpReq, httpResp, pendingReq);
+			return null;
+		
 		} else if (pendingReq.isPassiv()) {
-			if (tryperform) {
+			if (isSessionAuthenticated) {
 				// Passive authentication ok!
-				revisionsLogger.logEvent(oaParam, 
-						pendingReq, MOAIDEventConstants.AUTHPROCESS_FINISHED);
+				revisionsLogger.logEvent(oaParam, pendingReq, MOAIDEventConstants.AUTHPROCESS_FINISHED);
 				return moaSession;
 				
 			} else {				
@@ -462,7 +259,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 				
 			}
 		} else {
-			if (tryperform) {
+			if (isSessionAuthenticated) {
 				// Is authenticated .. proceed
 				revisionsLogger.logEvent(oaParam, 
 						pendingReq, MOAIDEventConstants.AUTHPROCESS_FINISHED);
@@ -476,6 +273,50 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 		}		
 	}
 	
+	/**
+	 * Checks if a authenticated MOASession already exists and if {protocolRequest} is authenticated
+	 * 
+	 * @param protocolRequest Authentication request which is actually in process
+	 * @param moaSession MOASession with authentication information or null if no active MOASession exists
+	 * 
+	 * @return true if session is already authenticated, otherwise false
+	 * @throws MOAIDException 
+	 */
+	private boolean tryPerformAuthentication(RequestImpl protocolRequest, AuthenticationSession moaSession) {
+
+		//if no MOASession exist -> authentication is required
+		if (moaSession == null) {
+			return false;
+			
+		} else {
+			//if MOASession is Found but not authenticated --> authentication is required
+			if (!moaSession.isAuthenticated()) {
+				return false;
+			}
+			
+			//if MOASession is already authenticated and protocol-request is authenticated 
+			//  --> no authentication is required any more
+			else if (moaSession.isAuthenticated() && protocolRequest.isAuthenticated()) {
+				return true;
+
+			// if MOASession is authenticated and SSO is allowed --> authenticate pendingRequest
+			} else if (!protocolRequest.isAuthenticated() 
+					&& moaSession.isAuthenticated() && protocolRequest.needSingleSignOnFunctionality()) {
+				Logger.debug("Found active MOASession and SSO is allowed --> pendingRequest is authenticted");
+				protocolRequest.setAuthenticated(true);
+				protocolRequest.setMOASessionIdentifier(moaSession.getSessionID());
+				return true;
+				
+			}
+			
+			// force authentication as backup solution
+			else {
+				Logger.warn("Authentication-required check find an unsuspected state --> force authentication");
+				return false;
+				
+			}					
+		}
+	}
 	
 	private void startAuthenticationProcess(HttpServletRequest httpReq,
 			HttpServletResponse httpResp, RequestImpl pendingReq)
@@ -505,37 +346,64 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 		}
 		
 		//create authentication process execution context
-		try {
-			// create execution context				
+		ExecutionContext executionContext = new ExecutionContextImpl();
+		
+		executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_INTERFEDERATION_ENTITYID, 
+				MiscUtil.isNotEmpty(
+						pendingReq.getGenericData(RequestImpl.DATAID_INTERFEDERATIOIDP_URL, String.class)));
+		
+		boolean leagacyMode = (legacyallowed && legacyparamavail);			
+		executionContext.put("isLegacyRequest", leagacyMode);
+		executionContext.put("performBKUSelection", !leagacyMode 
+				&& MiscUtil.isEmpty(pendingReq.getGenericData(RequestImpl.DATAID_INTERFEDERATIOIDP_URL, String.class)));
+						
+		//add leagcy parameters to context
+		if (leagacyMode) {
+			Enumeration<String> reqParamNames = httpReq.getParameterNames();
+			while(reqParamNames.hasMoreElements()) {
+				String paramName = reqParamNames.nextElement();
+				if (MiscUtil.isNotEmpty(paramName) && 
+						MOAIDAuthConstants.LEGACYPARAMETERWHITELIST.contains(paramName))
+					executionContext.put(paramName, httpReq.getParameter(paramName));
+				
+			}			
+		}
+		
+		//start process engine
+		startProcessEngine(pendingReq, executionContext);
+		
+	}
+			
+	private void sendSingleSignOnConsentsEvaluation(HttpServletRequest request,
+			HttpServletResponse response, RequestImpl pendingReq)
+			throws ServletException, IOException, MOAIDException { 
+			
+			Logger.info("Start SSO user-consents evaluation ...");
+		
+			//set authenticated flag to false, because user consents is required
+			pendingReq.setAuthenticated(false);
+			
+			//create execution context
 			ExecutionContext executionContext = new ExecutionContextImpl();
-			executionContext.put(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID, pendingReq.getRequestID());			
-			executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_INTERFEDERATION_ENTITYID, 
-					MiscUtil.isNotEmpty(
-							pendingReq.getGenericData(RequestImpl.DATAID_INTERFEDERATIOIDP_URL, String.class)));
+			executionContext.put(SingleSignOnConsentsModuleImpl.PARAM_SSO_CONSENTS_EVALUATION, true);
 			
-			boolean leagacyMode = (legacyallowed && legacyparamavail);			
-			executionContext.put("isLegacyRequest", leagacyMode);
-			executionContext.put("performBKUSelection", !leagacyMode 
-					&& MiscUtil.isEmpty(pendingReq.getGenericData(RequestImpl.DATAID_INTERFEDERATIOIDP_URL, String.class)));
-							
-			//add leagcy parameters to context
-			if (leagacyMode) {
-				Enumeration<String> reqParamNames = httpReq.getParameterNames();
-				while(reqParamNames.hasMoreElements()) {
-					String paramName = reqParamNames.nextElement();
-					if (MiscUtil.isNotEmpty(paramName) && 
-							MOAIDAuthConstants.LEGACYPARAMETERWHITELIST.contains(paramName))
-						executionContext.put(paramName, httpReq.getParameter(paramName));
-					
-				}			
-			}						
+			//start process engine
+			startProcessEngine(pendingReq, executionContext);
+		 
+	}
+	
+	private void startProcessEngine(RequestImpl pendingReq, ExecutionContext executionContext) throws MOAIDException {
+		try {
+			//put pending-request ID on execurtionContext
+			executionContext.put(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID, pendingReq.getRequestID());			
+						
 			// create process instance
 			String processDefinitionId = ModuleRegistration.getInstance().selectProcess(executionContext);
 
 			if (processDefinitionId == null) {
-				Logger.warn("No suitable process found for SessionID " + moasession.getSessionID() );
+				Logger.warn("No suitable process found for SessionID " + pendingReq.getRequestID() );
 				throw new MOAIDException("process.02",new Object[] {
-						moasession.getSessionID()});
+						pendingReq.getRequestID()});
 			}
 
 			String processInstanceId = processEngine.createProcessInstance(processDefinitionId, executionContext);
@@ -545,18 +413,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 
 			//store pending-request			
 			requestStoreage.storePendingRequest(pendingReq);
-			
-			
-			// make sure moa session has been persisted before running the process
-			try {
-				authenticatedSessionStore.storeSession(moasession);
-				
-			} catch (MOADatabaseException e) {
-				Logger.error("Database Error! MOASession is not stored!");
-				throw new MOAIDException("init.04", new Object[] {
-						moasession.getSessionID()});
-			}
-						
+									
 	    	// start process
 			processEngine.start(processInstanceId);
 			
@@ -572,32 +429,163 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 				}									
 			}
 			
-			throw new MOAIDException("process.01", new Object[] { pendingReq.getProcessInstanceId(), moasession }, e);
-		}			
+			throw new MOAIDException("process.01", new Object[] { pendingReq.getProcessInstanceId(), pendingReq.getRequestID() }, e);
+		}		
 	}
-			
-	private void sendTransmitAssertionQuestion(HttpServletRequest request,
-			HttpServletResponse response, IRequest target, IOAAuthParameters oaParam)
-			throws ServletException, IOException, MOAIDException { 
-		
-			//TODO: change to process management version!!!!
+	
+	private void performSingleLogOut(HttpServletRequest httpReq,
+	HttpServletResponse httpResp, AuthenticationSession session, PVPTargetConfiguration pvpReq, String authURL) throws MOAIDException {		
+		String pvpSLOIssuer = null;
+		String inboundRelayState = null;
 		
-			//set authenticated flag to false, because user consents is required
-			target.setAuthenticated(false);
+		if (pvpReq != null) {
+			MOARequest samlReq = (MOARequest) pvpReq.getRequest();
+			LogoutRequest logOutReq = (LogoutRequest) samlReq.getSamlRequest();
+			pvpSLOIssuer = logOutReq.getIssuer().getValue();
+			inboundRelayState = samlReq.getRelayState();
+			
+		}
 		
+		//store active OAs to SLOContaine
+		List<OASessionStore> dbOAs = authenticatedSessionStore.getAllActiveOAFromMOASession(session);
+		List<InterfederationSessionStore> dbIDPs = authenticatedSessionStore.getAllActiveIDPsFromMOASession(session);
+		SLOInformationContainer sloContainer = new SLOInformationContainer();
+		sloContainer.setSloRequest(pvpReq);
+		sloContainer.parseActiveIDPs(dbIDPs, pvpSLOIssuer);
+		sloContainer.parseActiveOAs(dbOAs, pvpSLOIssuer);
+						
+		//terminate MOASession
+		try {
+			authenticatedSessionStore.destroySession(session.getSessionID());
+			ssoManager.deleteSSOSessionID(httpReq, httpResp);
 			
-//			String form = SendAssertionFormBuilder.buildForm(target.requestedModule(), 
-//					target.requestedAction(), target.getRequestID(), oaParam, 
-//					target.getAuthURL());
-
-			String form =null;
+		} catch (MOADatabaseException e) {
+			Logger.warn("Delete MOASession FAILED.");
+			sloContainer.putFailedOA(pvpReq.getAuthURL());
 			
-			revisionsLogger.logEvent(target.getOnlineApplicationConfiguration(), 
-					target, MOAIDEventConstants.AUTHPROCESS_SSO_ASK_USER_START);
+		}
+		
+		//start service provider back channel logout process
+		Iterator<String> nextOAInterator = sloContainer.getNextBackChannelOA();	
+		while (nextOAInterator.hasNext()) {
+			SLOInformationImpl sloDescr = sloContainer.getBackChannelOASessionDescripten(nextOAInterator.next());
+			LogoutRequest sloReq = SingleLogOutBuilder.buildSLORequestMessage(sloDescr);
+
+			try {
+				List<XMLObject> soapResp = MOASAMLSOAPClient.send(sloDescr.getServiceURL(), sloReq);
+				
+				LogoutResponse sloResp = null;						
+				for (XMLObject el : soapResp) {
+					if (el instanceof LogoutResponse)
+						sloResp = (LogoutResponse) el;							
+				}
+				
+				if (sloResp == null) {
+					Logger.warn("Single LogOut for OA " + sloReq.getIssuer().getValue()
+							+ " FAILED. NO LogOut response received.");
+					sloContainer.putFailedOA(sloReq.getIssuer().getValue());
+					
+				} else {
+					SAMLVerificationEngine engine = new SAMLVerificationEngine();
+					engine.verifySLOResponse(sloResp, 
+							TrustEngineFactory.getSignatureKnownKeysTrustEngine());
+					
+				}
+								
+				SingleLogOutBuilder.checkStatusCode(sloContainer, sloResp);
+										
+			} catch (SOAPException e) {
+				Logger.warn("Single LogOut for OA " + sloReq.getIssuer().getValue()
+						+ " FAILED.", e);
+				sloContainer.putFailedOA(sloReq.getIssuer().getValue());
+				
+			} catch (SecurityException | InvalidProtocolRequestException e) {
+				Logger.warn("Single LogOut for OA " + sloReq.getIssuer().getValue()
+						+ " FAILED.", e);
+				sloContainer.putFailedOA(sloReq.getIssuer().getValue());
+				
+			}					
+		}
+						
+		//start service provider front channel logout process
+		try {
+			if (sloContainer.hasFrontChannelOA()) {
+				String relayState = Random.nextRandom();
+				
+				Collection<Entry<String, SLOInformationImpl>> sloDescr = sloContainer.getFrontChannelOASessionDescriptions();
+				List<String> sloReqList = new ArrayList<String>();
+				for (Entry<String, SLOInformationImpl> el : sloDescr) {
+					LogoutRequest sloReq = SingleLogOutBuilder.buildSLORequestMessage(el.getValue());
+					try {
+						sloReqList.add(SingleLogOutBuilder.getFrontChannelSLOMessageURL(el.getValue().getServiceURL(), el.getValue().getBinding(), 
+								sloReq, httpReq, httpResp, relayState));
+						
+					} catch (Exception e) {
+						Logger.warn("Failed to build SLO request for OA:" + el.getKey());
+						sloContainer.putFailedOA(el.getKey());
+						
+					}														
+				}
+				
+				//put SLO process-information into transaction storage
+				transactionStorage.put(relayState, sloContainer);
+				
+				if (MiscUtil.isEmpty(authURL))
+					authURL = pvpReq.getAuthURL();
+				
+				String timeOutURL = authURL
+						+ "/idpSingleLogout"
+						+ "?restart=" + relayState;
+				
+		        VelocityContext context = new VelocityContext();
+		        context.put("redirectURLs", sloReqList);
+		        context.put("timeoutURL", timeOutURL);
+		        context.put("timeout", SLOTIMEOUT);
+		        ssoManager.printSingleLogOutInfo(context, httpResp);
+				
+								
+			} else {
+				if (pvpReq != null) {
+					//send SLO response to SLO request issuer
+					SingleLogoutService sloService = SingleLogOutBuilder.getResponseSLODescriptor(pvpReq);
+					LogoutResponse message = SingleLogOutBuilder.buildSLOResponseMessage(sloService, pvpReq, sloContainer.getSloFailedOAs());
+					SingleLogOutBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState);
+					
+				} else {
+					//print SLO information directly
+			        VelocityContext context = new VelocityContext();
+			        if (sloContainer.getSloFailedOAs() == null || 
+			        		sloContainer.getSloFailedOAs().size() == 0)
+			        	context.put("successMsg", 
+			        			MOAIDMessageProvider.getInstance().getMessage("slo.00", null));
+			        else
+			        	context.put("errorMsg", 
+			        			MOAIDMessageProvider.getInstance().getMessage("slo.01", null));
+			        ssoManager.printSingleLogOutInfo(context, httpResp);
+										
+				}
+									
+			}	
+								
+		} catch (MOADatabaseException e) {
+			Logger.error("MOA AssertionDatabase ERROR", e);
+			if (pvpReq != null) {
+				SingleLogoutService sloService = SingleLogOutBuilder.getResponseSLODescriptor(pvpReq);
+				LogoutResponse message = SingleLogOutBuilder.buildSLOErrorResponse(sloService, pvpReq, StatusCode.RESPONDER_URI);
+				SingleLogOutBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState);
+				
+			}else {
+				//print SLO information directly
+		        VelocityContext context = new VelocityContext();
+	        	context.put("errorMsg", 
+	        			MOAIDMessageProvider.getInstance().getMessage("slo.01", null));
+		        ssoManager.printSingleLogOutInfo(context, httpResp);
+									
+			}
 			
-			response.setContentType("text/html;charset=UTF-8");
-			PrintWriter out = new PrintWriter(response.getOutputStream()); 
-			out.print(form);
-			out.flush(); 
+		} catch (Exception e) {
+			// TODO Auto-generated catch block
+			e.printStackTrace();
+		}				
 	}
 }