This interface provides a mechanism managing the contents of an instance of the RevocationCache class, which in turn is layered on a pluggable StorageService. The most common use for this interface is to manage revocation records in support of the AdministrativeLogout feature, but it is generic and can be used to manage records in other RevocationCache instances, such as those used in the OIDC OP plugin.
The interface is a simple REST API via an administrative flow located at the path /idp/profile/admin/revocation and access is blocked by default. Like all administrative features, you have the ability to customize authentication and access control.
To the base path you must append:
/<RevocationCacheBeanID>/<context>/<key>
The bean ID specifies the specific bean of type RevocationCache. The context and key values will depend on the use case (e.g., see AdministrativeLogout for an example, also the examples below).
These HTTP methods are supported:
GET – query for a revocation record matching a particular key
PUT/POST – create or update the expiration of a revocation record
The request body must contain the URL encoded parameter value
(the record value to store), and optionally duration
(record lifetime in seconds or in XML duration syntax).
DELETE – remove a revocation record manually
$ curl -ik "https://localhost/idp/profile/admin/revocation/shibboleth.AuthnRevocationCache/LoginFlowRevocation/prin%21jdoe" HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 { "data" : { "type" : "revocation-records", "id" : "shibboleth.AuthnRevocationCache/prin!jdoe", "attributes" : { "revocation" : 1659638895 } } } $ curl -X PUT --data "value=1659638895" -ik "https://localhost/idp/profile/admin/revocation/shibboleth.AuthnRevocationCache/LoginFlowRevocation/prin%21jdoe" HTTP 1.1/202 Accepted $ curl -X DELETE -ik "https://localhost/idp/profile/admin/revocation/shibboleth.AuthnRevocationCache/LoginFlowRevocation/prin%21jdoe" HTTP/1.1 204 No Content |
The general properties configuring this flow via admin/admin.properties are:
|
To replace the internally defined flow descriptor bean, the following XML is required:
In older versions and upgraded systems, this list is defined in conf/admin/general-admin.xml. In V4.1+, no default version of the list is provided and it may simply be placed in conf/global.xml if needed. |