starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-05-04 18:08:46 +03:00
Code Issues 784 Packages Projects Releases 15 Wiki Activity

SAML SLS Logout not working, signature validation failed #1742

New Issue
Closed
opened 2026-02-05 01:45:29 +03:00 by OVERLORD · 7 comments
OVERLORD commented 2026-02-05 01:45:29 +03:00
Owner
Copy Link

Originally created by @whentotrade on GitHub (May 20, 2020).

Describe the bug
SAML Login workflow is working fine with configuration. However, SLS logout service failes on the bookstack SP with error message

"Invalid SLS Response: invalid_logout_response" with text
"Signature validation failed. Logout Response rejected."

The logout workflow works on the IdP as the user is logged out in the primary IdP environment. However, the HTTP-redirect binding for SO by bookstack delivers the error above. As result, the user is never logged out from bookstack, while correctly logged out at the other app by the IdP.

What is missing here? It looks like a missing signature which need to be set somewhere? But I cant see any additional options to configure the SAML processing via the env file. Is this related to the issue reported #1926 ?

Expected behavior
User should be logged out of the bookstack instance via the SAML SLS HTTP-redirect. As login is working and as the logout is processed correctly by the IdM provider app.

Additional context
#1926

Originally created by @whentotrade on GitHub (May 20, 2020). **Describe the bug** SAML Login workflow is working fine with configuration. However, SLS logout service failes on the bookstack SP with error message **"Invalid SLS Response: invalid_logout_response"** with text **"Signature validation failed. Logout Response rejected."** The logout workflow works on the IdP as the user is logged out in the primary IdP environment. However, the HTTP-redirect binding for SO by bookstack delivers the error above. As result, the user is never logged out from bookstack, while correctly logged out at the other app by the IdP. What is missing here? It looks like a missing signature which need to be set somewhere? But I cant see any additional options to configure the SAML processing via the env file. Is this related to the issue reported #1926 ? **Expected behavior** User should be logged out of the bookstack instance via the SAML SLS HTTP-redirect. As login is working and as the logout is processed correctly by the IdM provider app. **Additional context** #1926
OVERLORD commented 2026-02-05 01:45:36 +03:00
Author
Owner
Copy Link

@babington-andy commented on GitHub (Jun 15, 2020):

I'm experiencing the same issue, which IDP are you using?

I'm using Azure AD and when investigating the SAML logout response and attempting to validate it using https://www.samltool.com/validate_logout_res.php I get the same error message, so it appears that (at least in my case) the IDP is to blame because it's incorrectly signing the response. I could be wrong about that though, happy to be corrected.

@babington-andy commented on GitHub (Jun 15, 2020): I'm experiencing the same issue, which IDP are you using? I'm using Azure AD and when investigating the SAML logout response and attempting to validate it using https://www.samltool.com/validate_logout_res.php I get the same error message, so it appears that (at least in my case) the IDP is to blame because it's incorrectly signing the response. I could be wrong about that though, happy to be corrected.
OVERLORD commented 2026-02-05 01:45:38 +03:00
Author
Owner
Copy Link

@whentotrade commented on GitHub (Aug 10, 2020):

@babington-andy I am using a wordpess plugin as IdP - which works great with other SPs. Just the logout flow with bookstack is giving this error. I how no solution until now..

@whentotrade commented on GitHub (Aug 10, 2020): @babington-andy I am using a wordpess plugin as IdP - which works great with other SPs. Just the logout flow with bookstack is giving this error. I how no solution until now..
OVERLORD commented 2026-02-05 01:45:40 +03:00
Author
Owner
Copy Link

@deano2point0 commented on GitHub (Oct 23, 2020):

I am receiving the same Error message using Azure AD as my idP. Been trying to solve it without any success.

@deano2point0 commented on GitHub (Oct 23, 2020): I am receiving the same Error message using Azure AD as my idP. Been trying to solve it without any success.
OVERLORD commented 2026-02-05 01:45:45 +03:00
Author
Owner
Copy Link

@tmrhymer commented on GitHub (Jan 18, 2021):

Also experiencing this. Eventually the authentication session expires on Bookstack but its concerning that the Logout button does not actually log you out of Bookstack with SAML enabled.

@tmrhymer commented on GitHub (Jan 18, 2021): Also experiencing this. Eventually the authentication session expires on Bookstack but its concerning that the Logout button does not actually log you out of Bookstack with SAML enabled.
OVERLORD commented 2026-02-05 01:45:47 +03:00
Author
Owner
Copy Link

@ehv1 commented on GitHub (Aug 18, 2021):

I expierenced the same problem, but also found a way to fix this.

Please take a look here:
https://stackoverflow.com/questions/41894290/centrify-azure-as-idp-does-not-return-logoutresponse-on-single-log-out

[snip]
UPDATE regarding Azure

If you are using the Onelogin PHP Toolkit, then you also have to enable the 'retrieveParametersFromServer'-Setting, otherwise the logout response will always end up with a 'Signature validation failed. Logout Request rejected' error.
[/snip]

So the solution is to change the third parameter from false to true in the $toolkit->processSLO function in class BookStack\Auth\Access\Saml2Service:

/**
 * Process a response for the single logout service.
 * @throws Error
 */
public function processSlsResponse(?string $requestId): ?string
{
    $toolkit = $this->getToolkit();
    $redirect = $toolkit->processSLO(true, $requestId, true, null, true);

    $errors = $toolkit->getErrors();
	
    if (!empty($errors)) {
        throw new Error(
            'Invalid SLS Response: '.implode(', ', $errors)
        );
    }

    $this->actionLogout();
    return $redirect;
}

Eventually this will lead to the function OneLogin\Saml2\Utils::validateBinarySign being called with the 4th parameter $retrieveParametersFromServer to be true instead of false.
According to the function description this parameter indicates where to get the values in order to validate the Sign, from getData or from $_SERVER.

So in case of Azure, this needs to be truthy and fetched from $_SERVER['QUERY_STRING'].

I just tested it and it works like a charm!

@ehv1 commented on GitHub (Aug 18, 2021): I expierenced the same problem, but also found a way to fix this. Please take a look here: https://stackoverflow.com/questions/41894290/centrify-azure-as-idp-does-not-return-logoutresponse-on-single-log-out [snip] UPDATE regarding Azure **If you are using the Onelogin PHP Toolkit, then you also have to enable the 'retrieveParametersFromServer'-Setting, otherwise the logout response will always end up with a 'Signature validation failed. Logout Request rejected' error.** [/snip] So the solution is to change the third parameter from false to true in the $toolkit->processSLO function in class BookStack\Auth\Access\Saml2Service: /** * Process a response for the single logout service. * @throws Error */ public function processSlsResponse(?string $requestId): ?string { $toolkit = $this->getToolkit(); $redirect = $toolkit->processSLO(true, $requestId, true, null, true); $errors = $toolkit->getErrors(); if (!empty($errors)) { throw new Error( 'Invalid SLS Response: '.implode(', ', $errors) ); } $this->actionLogout(); return $redirect; } Eventually this will lead to the function OneLogin\Saml2\Utils::validateBinarySign being called with the 4th parameter $retrieveParametersFromServer to be true instead of false. According to the function description this parameter indicates where to get the values in order to validate the Sign, from getData or from $_SERVER. So in case of Azure, this needs to be truthy and fetched from $_SERVER['QUERY_STRING']. I just tested it and it works like a charm!
OVERLORD commented 2026-02-05 01:45:49 +03:00
Author
Owner
Copy Link

@justarandomsysadmin commented on GitHub (Sep 9, 2021):

I just tested it and it works like a charm!

I can not confirm that. I'm also using Azure and had experienced the logout error from the title. When I switch that parameter from false to true I just get an Azure Error instead of that bookstack error (and I'm still logged in).

AADSTS50068: Signout failed. The initiating application is not a participant in the current session.

@justarandomsysadmin commented on GitHub (Sep 9, 2021): > I just tested it and it works like a charm! I can not confirm that. I'm also using Azure and had experienced the logout error from the title. When I switch that parameter from false to true I just get an Azure Error instead of that bookstack error (and I'm still logged in). **AADSTS50068: Signout failed. The initiating application is not a participant in the current session.**
OVERLORD commented 2026-02-05 01:45:50 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Oct 25, 2021):

As per #2902, and issue #1925, a range of changes have now been made for BookStack v21.10.

The new SAML2_SP_x509 and SAML2_SP_x509_KEY options, which enable SP SLS signing, can be seen in the updated documentation:
https://www.bookstackapp.com/docs/admin/saml2-auth/
For ADFS usage, these will need to be set with a service provider certificate and key, with the certificate also added on the ADFS side for SLS request signing.

Will therefore close this off but please open a new issue if there are problems with the updated implementation.

@ssddanbrown commented on GitHub (Oct 25, 2021): As per #2902, and issue #1925, a range of changes have now been made for BookStack v21.10. The new `SAML2_SP_x509` and `SAML2_SP_x509_KEY` options, which enable SP SLS signing, can be seen in the updated documentation: https://www.bookstackapp.com/docs/admin/saml2-auth/ For ADFS usage, these will need to be set with a service provider certificate and key, with the certificate also added on the ADFS side for SLS request signing. Will therefore close this off but please open a new issue if there are problems with the updated implementation.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/BookStack#1742
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?