Return to referring site after SAML IDP Logout

[Steve Christensen]

My website (www.home.lan) uses SIMPLESAMLPHP and when a user logs in they authenticate against WebADM OpenID & SAML Provider..

<?php

  require_once('_autoload.php');

  $as = new SimpleSAML_Auth_Simple('default-sp');

  $as->requireAuth();

  $attributes = $as->getAttributes();

?>

takes the user to the WebADM OpenID/SAML server where they authenticate...

https://dev1.home.lan/webapps/openid/openotp.php?SAMLRequest=

After they authenticate they are automatically redirected after 2 seconds back to the referring page (www.home.lan).

When a user logs off using:

<form action="https://www.home.lan/saml/module.php/core/authenticate.php?as=default-sp&logout" method="post"><button type="submit">Logout</button></form>

it takes them to:

https://dev1.home.lan/webapps/openid/logout.php?SAMLRequest=XXXX

The screen says "Logged out from SAML SSO service" and there is a "Close" button.

When you click on the close button I just get a blank white screen.  If I manually go back to www.home.lan I can see that I am successfully logged out.

How do I automatically redirect back to the original site?

Thanks,

Steve

[Benoît Jager (RCDevs)]

Hello,

Can you enable the setting Disable Confirmation in configure of Application->OpenID?

Best regards

[Steve Christensen]

I checked the "Disable Confirmation" box and changed it from No (Default) to Yes but the behavior is the same.

After more digging, I determined that I can tear down the session on the SIMPLESAML side using the following code:

<?php

// Include Library

include_once('lib.php');

// Pull in Autoload for SimpleSAML

require_once('_autoload.php');

// Access SP session

$idpAuth = new \SimpleSAML\Auth\Simple('default-sp');

// Logout to SAML test

$idpAuth->logout('https://www.home.lan/index.php');

?>

I am going to try that instead of ending the session on the IDP side.  I don't know if there is a "correct" way from a security standpoint.

Thanks,

Steve

[Steve Christensen]

I put the above code in logoff.php and get the same behavior.  Successfully log off but am still stuck on the OpenID logoff page.  Any other thoughts?

Thanks,

Steve