Support different SAML NameIDFormats (e.g. urn:oasis:names:tc:SAML:2.0:nameid-format:persistent) #5453

New Issue

OVERLORD · 2026-02-05T10:04:43+03:00

OVERLORD commented

2026-02-05 10:04:43 +03:00

Originally created by @nwintering on GitHub (Oct 9, 2025).

Describe the feature you'd like

Bookstack only supports the SAML NameIDFormat urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress. However, other IdPs such as Shibboleth do not support this format out of the box. In our case, we had to manually configure our Shibboleth-IdP to support the email-format but this still brakes the Single Log Out feature.
Other projects using SAML-Toolkit seem to show similar problems with Single Log Out and the email-format (see this issue).

Formats such as urn:oasis:names:tc:SAML:2.0:nameid-format:persistent and urn:oasis:names:tc:SAML:2.0:nameid-format:transient seem to be more common and do not require special configuration for IdP administrators.
Since the persistent-format is a long-lived unique identifier, similar to a mail address, this format should not break any logic as long as the mail attribute is still transmitted.

Describe the benefits this would bring to existing BookStack users

At least for Shibboleth IdP administrators, supporting the urn:oasis:names:tc:SAML:2.0:nameid-format:persistent-NameIDFormat would decrease configuration effort.
Moreover, it would enable Single Log Out for such deployments.

End users should not notice any changes.

Can the goal of this request already be achieved via other means?

We tried to override the NameIDFormat as described in #2367 but this lead to user landing on the log-in page again after finishing the SAML authentication flow.

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

How long have you been using BookStack?

1 to 5 years

Additional context

The NameIDFormat is hard coded at least here: 146a6c01cc/app/Access/Saml2Service.php (L69)

Originally created by @nwintering on GitHub (Oct 9, 2025). ### Describe the feature you'd like Bookstack only supports the SAML NameIDFormat `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. However, other IdPs such as Shibboleth do not support this format out of the box. In our case, we had to manually configure our Shibboleth-IdP to support the email-format but this still brakes the Single Log Out feature. Other projects using SAML-Toolkit seem to show similar problems with Single Log Out and the email-format (see [this issue](https://github.com/SAML-Toolkits/php-saml/issues/516)). Formats such as `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` and `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` seem to be more common and do not require special configuration for IdP administrators. Since the persistent-format is a long-lived unique identifier, similar to a mail address, this format should not break any logic as long as the mail attribute is still transmitted. ### Describe the benefits this would bring to existing BookStack users At least for Shibboleth IdP administrators, supporting the `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`-NameIDFormat would decrease configuration effort. Moreover, it would enable Single Log Out for such deployments. End users should not notice any changes. ### Can the goal of this request already be achieved via other means? We tried to override the NameIDFormat as described in #2367 but this lead to user landing on the log-in page again after finishing the SAML authentication flow. ### Have you searched for an existing open/closed issue? - [x] I have searched for existing issues and none cover my fundamental request ### How long have you been using BookStack? 1 to 5 years ### Additional context The NameIDFormat is hard coded at least here: https://github.com/BookStackApp/BookStack/blob/146a6c01cc89a355b0d95af0ff22de64a42372b3/app/Access/Saml2Service.php#L69

OVERLORD added the 🔨 Feature Request 🚪 Authentication labels 2026-02-05 10:04:43 +03:00

OVERLORD commented

2026-02-05 10:04:45 +03:00

@jdede commented on GitHub (Nov 21, 2025):

I managed to get the Shibboleth login working with the override as mentioned in my PR #5907
However, my issue is now the logout, where I can not use the override as the NAMEID_EMAIL_ADDRESS is hardcoded in BookStack.

@jdede commented on GitHub (Nov 21, 2025): I managed to get the Shibboleth login working with the override as mentioned in my PR #5907 However, my issue is now the logout, where I can not use the override as the `NAMEID_EMAIL_ADDRESS` is hardcoded in BookStack.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5453