[bug] IDP initiated SLO is not revoking the session

Steps to reproduce

1. Login to Nextcloud using SAML
2. End the session from the IDP (or another SP)
3. Notice nothing seems to happen on the nextcloud side

Expected behaviour

We should see the session being revoked, just like revoking a session from the settings page.
If we revoke the session from the sessions page we get pushed back to the login page right away.

Actual behaviour

The session doesn't actually get revoked.

It seems:
$this->userSession->logout
Does NOT actually revoke the targeted session.

To be frankfully honest, I don't think $this->userSession->logout is actually pointed towards the session the recieved SLO request is targeted at at all.

It seems there is no way to get get a nextcloud session from the information given in the recieved SLO-request.
To fix this needs some significant work, which i'm not qualified for. We need some way of finding out nextcloud sessions from the information from the IDP and triggering logout on THAT userSession.

Till such a feature is in, we should remove any mention of SLO and be clear SLO is currently not supported/working. It hasn't been since the nextcloud auth backend changed some time ago. Certainly enterprise consumers need to know this before paying for Nextcloud, because this could be a make-or-break feature for a lot of them.

Server configuration

Operating system: Any

Web server: Any

Database: Any

PHP version: Any (current version)

Nextcloud version: (see Nextcloud admin page)
Any (afaik) and/or 19

Where did you install Nextcloud from:
Multiple ways from docker to local installs

List of activated apps:
plain install + user_saml

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nextcloud configuration:
Not really relevant, it isn't a config issue.

Client configuration

Browser:
Chrome (multiple versions) firefox multiple versions

Operating system:
Linux, Windows, OSX

Logs

Nextcloud log (data/owncloud.log)

Logs aren't helpfull because user_saml lacks any debug code.
Manually adding debug code after every step shows all steps in the SLO code-patch (SLS) are executed just fine.
It's just the fact $this->userSession->logout doesn't revoke the session.

Browser log

There is no browser during an idp initiated SLO request (okey, technically there is... but it isn't relevant... as stated above the codepath for SLO is correctly executed once a get or post SLO request is recieved.

Notes

The following data is stored with the (to be revoked) token:

				$token,
				$uid,
				$loginName,
				$password,
				$name,
				$type,
				$remember

Nothing in there would be able to be fetched based on a SLO request.
We either need to:

• loop through the user_saml data for each and every session for said user
• Keep track of which saml sessions connect to which Nextcloud sessions

Start by tracing the IDP-initiated SLO code path and the userSession->logout call, then compare the session data listed in the issue with the information available in the received SLO request. Determine how the targeted Nextcloud session can be identified and revoked; done means the affected session is invalidated and the user is returned to the login page, as with settings-page revocation.