| 1927 | skip_sync_on_auth = True |
| 1928 | |
| 1929 | def execute(self, params, **kwargs): |
| 1930 | if msp.current_mc_id: |
| 1931 | msp.current_mc_id = None |
| 1932 | msp.mc_params_dict.clear() |
| 1933 | |
| 1934 | if params.session_token: |
| 1935 | try: |
| 1936 | api.communicate_rest(params, None, 'vault/logout_v3') |
| 1937 | except: |
| 1938 | pass |
| 1939 | |
| 1940 | # Clean up Rust WebRTC tube registry if it exists |
| 1941 | try: |
| 1942 | from .tunnel.port_forward.tunnel_helpers import cleanup_tube_registry |
| 1943 | cleanup_tube_registry(params) |
| 1944 | except Exception as e: |
| 1945 | logging.debug('Tube registry cleanup error: %s', e) |
| 1946 | |
| 1947 | if params.sso_login_info and 'idp_session_id' in params.sso_login_info: |
| 1948 | sso_url = params.sso_login_info.get('sso_url') or '' |
| 1949 | sp_url_builder = urllib.parse.urlparse(sso_url) |
| 1950 | sp_url_query = urllib.parse.parse_qsl(sp_url_builder.query) |
| 1951 | session_id = params.sso_login_info.get('idp_session_id') or '' |
| 1952 | if params.sso_login_info.get('is_cloud'): |
| 1953 | sso_rq = ssocloud_pb2.SsoCloudRequest() |
| 1954 | sso_rq.clientVersion = rest_api.CLIENT_VERSION |
| 1955 | sso_rq.embedded = True |
| 1956 | sso_rq.username = params.user.lower() |
| 1957 | sso_rq.idpSessionId = session_id |
| 1958 | transmission_key = utils.generate_aes_key() |
| 1959 | rq_payload = APIRequest_pb2.ApiRequestPayload() |
| 1960 | rq_payload.apiVersion = 3 |
| 1961 | rq_payload.payload = sso_rq.SerializeToString() |
| 1962 | api_rq = APIRequest_pb2.ApiRequest() |
| 1963 | api_rq.locale = params.rest_context.locale or 'en_US' |
| 1964 | |
| 1965 | server_public_key = rest_api.SERVER_PUBLIC_KEYS[params.rest_context.server_key_id] |
| 1966 | if isinstance(server_public_key, rsa.RSAPublicKey): |
| 1967 | api_rq.encryptedTransmissionKey = crypto.encrypt_rsa(transmission_key, server_public_key) |
| 1968 | elif isinstance(server_public_key, ec.EllipticCurvePublicKey): |
| 1969 | api_rq.encryptedTransmissionKey = crypto.encrypt_ec(transmission_key, server_public_key) |
| 1970 | else: |
| 1971 | raise ValueError('Invalid server public key') |
| 1972 | api_rq.publicKeyId = params.rest_context.server_key_id |
| 1973 | api_rq.encryptedPayload = crypto.encrypt_aes_v2(rq_payload.SerializeToString(), transmission_key) |
| 1974 | sp_url_query.append(('payload', utils.base64_url_encode(api_rq.SerializeToString()))) |
| 1975 | else: |
| 1976 | sp_url_query.append(('embedded', '')) |
| 1977 | sp_url_query.append(('token', '')) |
| 1978 | sp_url_query.append(('user', params.user.lower())) |
| 1979 | if session_id: |
| 1980 | sp_url_query.append(('session_id', session_id)) |
| 1981 | |
| 1982 | sp_url_builder = sp_url_builder._replace(path=sp_url_builder.path.replace('/login', '/logout'), query=urllib.parse.urlencode(sp_url_query, doseq=True)) |
| 1983 | sp_url = urllib.parse.urlunparse(sp_url_builder) |
| 1984 | logging.info('SSO Logout URL\n%s', sp_url) |
| 1985 | |
| 1986 | # Preserve commands queue (clear_session() clears it, but we need 'q' to exit) |