mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-25 11:19:39 +03:00
Error with SAML logout when using ADFS #5570
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @awittendorff on GitHub (Jan 16, 2026).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
Configured Bookstack to use SAML for authentication and using ADFS as IDP.
Login works, but logout fails with An Error occured on the /saml2/sls endpoint.
APP_Debug in .env, gives the following error: OneLogin\Saml2\Error
Invalid SLS Response: logout_not_success
And Internal Error 500 response.
On ADFS server I seen this:
Error 368
The SAML Single Logout request does not correspond to the logged-in session participant.
Requestor: https://guide01-test.domain.net/saml2/metadata
Request name identifier: Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress, NameQualifier: SPNameQualifier: , SPProvidedId:
Logged-in session participants:
Count: 1, [Issuer: https://guide01-test.domain.net/saml2/metadata, NameID: (Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress, NameQualifier: SPNameQualifier: , SPProvidedId: )]
This request failed.
User Action
Verify that the claim provider trust or the relying party trust configuration is up to date. If the name identifier in the request is different from the name identifier in the session only by NameQualifier or SPNameQualifier, check and correct the name identifier policy issuance rule using the AD FS Management snap-in.
Searched previous issues but haven't something the resolves this specific issue, but multiple point to signature validation errors, which is not the case here.
Exact BookStack Version
24.10.2
Log Content
Hosting Environment
Running on virtual server with Ubuntu 24.04
@ssddanbrown commented on GitHub (Jan 22, 2026):
Hi @awittendorff,
I'm assuming that you've removed personal details from the provided ADFS server error?
If so, in the original version of the following:
Can you describe how/if the user details in the first line differ to that in the last line?
Or was the ADFS error logged with blank details as provided above?
@awittendorff commented on GitHub (Jan 23, 2026):
The only thing changed from the original error on ADFS server is the FQDN in Requestor:/Issuer:
So error logged with blank details