Django 5 compatibility bug in the logout flow (with Shibboleth)

Description / Beschreibung

with help of ChatGPT

With Shibboleth as the only authentication backend and

LOGOUT_URL = '/account/shibboleth/logout/'

the logout results in:

GET /account/shibboleth/logout/
  -> 302 /account/logout/?next=/Shibboleth.sso/Logout

GET /account/logout/?next=/Shibboleth.sso/Logout
  -> 405 Method Not Allowed

shibboleth_logout() currently redirects to account_logout, which resolves to Django's LogoutView when django-allauth is disabled.

Since Django 5, LogoutView no longer supports logout via GET and requires POST, so the redirect results in a 405 response.

Expected behaviour / Erwartetes Verhalten

RDMO should first terminate the local Django session and then redirect to SHIBBOLETH_LOGOUT_URL, e.g.:

POST /account/shibboleth/logout/
  -> Django logout
  -> 302 /Shibboleth.sso/Logout

A possible fix would be for shibboleth_logout() to call django.contrib.auth.logout() directly and then redirect to SHIBBOLETH_LOGOUT_URL. The logout action in the navigation should use a POST form instead of a GET link.

This may also affect non-allauth installations in general, since the navigation uses a link to /account/logout/ while Django's LogoutView is POST-only.

Context / Kontext

Please state your operating system, the RDMO version, and (if applicable) the browser the error occurred in.

References / Verweise

• https://docs.djangoproject.com/en/5.2/topics/auth/default/#how-to-log-a-user-out
• https://github.com/rdmorganiser/rdmo/blob/9f48c2fc93e021ff8eef3e087c1368235bef2e56/rdmo/accounts/views.py#L107