SLO Request is not signed

Steps to reproduce

1. Set up Nextcloud with user_saml module
2. Connect to an SAML IdP and chooes to sign the SLO request
3. Log in and out using the SAML IdP

Expected behaviour

The SLO request should be signed by Nextcloud that IdPs which requires signed requests can handle them.

Actual behaviour

The SLO request is not signed and will be rejected by IdPs which requires signature.
See:
<samlp:LogoutRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="ONELOGIN_4e7fba9ea8d435e56b57142f9d44c6bbada56fec"
Version="2.0"
IssueInstant="2019-11-26T07:17:28Z"
Destination="https://b2access.eudat.eu/saml-idp/SLO-WEB">
saml:Issuerhttps://b2drop.eudat.eu/apps/user_saml/saml/metadata</saml:Issuer>
saml:NameIDefa6e445-dc56-432d-9ffa-c39a921a2d90</saml:NameID>
samlp:SessionIndexSAMLY2lib_assert_a41de85cef47bf4bccc82f2cb53c7dc8b6062304166e82e0</samlp:SessionIndex>
</samlp:LogoutRequest>

Server configuration

Operating system: CentOS 7.3

Web server: Apache 2

Database: MariaDB

PHP version: 7.2

Nextcloud version: 16.0.6

Where did you install Nextcloud from: tar-file

List of activated apps:
Enabled:

• accessibility: 1.2.0
• activity: 2.9.1
• admin_audit: 1.6.0
• announcementcenter: 3.5.1
• b2sharebridge: 1.1.0
• calendar: 1.7.1
• checksum: 0.4.3
• cloud_federation_api: 0.2.0
• comments: 1.6.0
• contacts: 3.1.6
• dav: 1.9.2
• federatedfilesharing: 1.6.0
• federation: 1.6.0
• files: 1.11.0
• files_pdfviewer: 1.5.0
• files_rightclick: 0.15.1
• files_sharing: 1.8.0
• files_texteditor: 2.8.0
• files_trashbin: 1.6.0
• files_versions: 1.9.0
• files_videoplayer: 1.5.0
• firstrunwizard: 2.5.0
• groupfolders: 4.1.4
• logreader: 2.1.0
• lookup_server_connector: 1.4.0
• lrswitchboardbridge: 0.2
• nextcloud_announcements: 1.5.0
• notifications: 2.4.1
• oauth2: 1.4.2
• password_policy: 1.6.0
• privacy: 1.0.0
• provisioning_api: 1.6.0
• quota_warning: 1.5.0
• recommendations: 0.4.0
• serverinfo: 1.6.0
• sharebymail: 1.6.0
• support: 1.0.0
• survey_client: 1.4.0
• systemtags: 1.6.0
• theming: 1.7.0
• twofactor_backupcodes: 1.5.0
• updatenotification: 1.6.0
• user_saml: 2.4.0
• viewer: 1.2.0
• workflowengine: 1.6.0

Nextcloud configuration:
{
"system": {
"instanceid": "REMOVED SENSITIVE VALUE",
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"b2drop.eudat.eu",
],
"version": "16.0.6.1",
"datadirectory": "REMOVED SENSITIVE VALUE",
"overwrite.cli.url": "https://b2drop.eudat.eu",
"dbtype": "mysql",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbtableprefix": "",
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"logtimezone": "UTC",
"installed": true,
"updatechecker": false,
"loglevel": 3,
"trashbin_retention_obligation": "auto, auto, auto, auto, auto, auto",
"memcache.local": "\OC\Memcache\APCu",
"mail_smtpmode": "smtp",
"mail_from_address": "REMOVED SENSITIVE VALUE",
"mail_domain": "REMOVED SENSITIVE VALUE",
"mail_smtphost": "REMOVED SENSITIVE VALUE",
"mail_smtpport": "25",
"mail_smtptimeout": 10,
"lost_password_link": "https://b2drop.eudat.eu/pwm/public/ForgottenPassword",
"htaccess.RewriteBase": "/",
"maintenance": false,
"ldapProviderFactory": "\OCA\User_LDAP\LDAPProviderFactory",
"ldapIgnoreNamingRules": false,
"theme": "b2drop",
"mysql.utf8mb4": true
},
"user_saml": {
"enabled": "yes",
"general-allow_local_accounts": "1",
"general-allow_multiple_user_back_ends": "1",
"general-idp0_display_name": "Login",
"general-login_button_text": "B2ACCESS",
"general-require_provisioned_account": "0",
"general-uid_mapping": "unity:persistent",
"general-use_saml_auth_for_desktop": "0",
"idp-entityId": "https://b2access.eudat.eu:8443/saml-idp/metadata",
"idp-singleLogoutService.url": "https://b2access.eudat.eu/saml-idp/SLO-WEB",
"idp-singleSignOnService.url": "https://b2access.eudat.eu/saml-idp/saml2idp-web",
"idp-x509cert": "REMOVED SENSITIVE VALUE",
"installed_version": "2.4.0",
"saml-attribute-mapping-displayName_mapping": "urn:oid:2.5.4.3",
"saml-attribute-mapping-email_mapping": "urn:oid:0.9.2342.19200300.100.1.3",
"security-authnRequestsSigned": "1",
"security-logoutRequestSigned": "1",
"security-logoutResponseSigned": "1",
"security-nameIdEncrypted": "0",
"security-signMetadata": "1",
"security-wantAssertionsSigned": "1",
"security-wantNameId": "1",
"security-wantXMLValidation": "1",
"sp-privateKey": "REMOVED SENSITIVE VALUE",
"sp-x509cert": "REMOVED SENSITIVE VALUE",
"type": "saml",
"types": "authentication"
},
}

Client configuration

Browser: Firefox 70.0.1

Operating system: Ubuntu 18.04

Logs

Nextcloud log (data/owncloud.log)

Nextcloud log does not provide infos on this.

Browser log

Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

The issue identifies the user_saml module and the SLO logout flow; begin by reproducing logout with security-logoutRequestSigned enabled and trace where the LogoutRequest is generated. Confirm completion by checking that the outgoing request is signed and accepted by an IdP requiring signatures; no file or test is named in the report.