mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-07 19:06:05 +03:00
SAML SLS Logout #3458
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @knuz92 on GitHub (Jan 18, 2023).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I use simplesamlphp for my SSO server. It is located on "sso.n.domain1.at". The BookStack instance is on "brain.domain2.at".
When I log in via SAML, everything works fine. Logging out via BookStack directly also works fine.
But when I logout via SAML SLS -> SAML sends a request to BookStack, it tries to delete the cookies, which is not possible because the browser does not change them for security reasons. (CSRF)
Why doesn't BookStack just delete the session server side? Is this a bug or do i have a configuration error there?
BookStack instances on the same Domain are working with fine SLS -> the Browser deletes the Cookies.
Exact BookStack Version
22.11.1
Log Content
BookStack Config:
AUTH_METHOD=saml2
AUTH_AUTO_INITIATE=true
SAML2_NAME="MY Login"
SAML2_EMAIL_ATTRIBUTE=mail
SAML2_EXTERNAL_ID_ATTRIBUTE=username
SAML2_DISPLAY_NAME_ATTRIBUTES=fullname
SAML2_IDP_ENTITYID=https://sso.n.domain1.at/sso/saml2/idp/metadata.php
SAML2_AUTOLOAD_METADATA=false
SAML2_IDP_SSO=https://sso.n.domain1.at/sso/saml2/idp/SSOService.php
SAML2_IDP_SLO=https://sso.n.domain1.at/sso/saml2/idp/SingleLogoutService.php
SAML2_IDP_x509="-----BEGIN CERTIFICATE-----
CRT HERE
-----END CERTIFICATE-----"
SAML2_USER_TO_GROUPS=true
SAML2_GROUP_ATTRIBUTE=groups
SAML2_REMOVE_FROM_GROUPS=true
Config SAML SP Remote:
$metadata['https://brain.domain2.at/saml2/metadata'] = [
'AssertionConsumerService' => 'https://brain.domain2.at/saml2/acs',
'SingleLogoutService' => 'https://brain.domain2.at/saml2/sls',
'simplesaml.nameidattribute' => 'username',
'simplesaml.attributes' => true,
'attributes' => [SOME ATTR HERE],
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
];
Browser blocks cookies:
PHP Version
8.1
Hosting Environment
Debian 11 with apache2
@ssddanbrown commented on GitHub (Jan 18, 2023):
Hi @knuz92,
I must admit, I've been away from the specific of SAML2 for a while so can't remember exactly what we support but I'll try my best to answer from memory.
BookStack does refresh the session server-side, but I think this would still provide cookies back so that a new session can be connected up.
Do you know if the logout request is loading via an iframe?
I have a feeling it is, making the logout request third-party and therefore any existing session cookies are not sent with the request, and therefore the session cannot be identified to be destroyed/refreshed on the BookStack side.
That would make sense since you say this works when on the same domain.
It may be possible that we could support other single logout schemes (Back-channel, alternative session identification) but It'd require time to investigate the options out there and their support by IDPs, to determine what's possible and if it's worthwihle to pursue & support.
@ssddanbrown commented on GitHub (Jan 26, 2023):
Since there's been no follow-up I'm going to close this. If the issue remains and is something you still require to be fixed respond to my previous comment and this can then be re-opened.