simplesamlphp / simplesamlphp/simplesamlphp-module-consent
Logout fails because SPEntityID is not in state
@monkeyiq is already working on this.
Since Jul 14, 2026.
- Dominant language
- PHP
- Stars
- 4
- Forks
- 7
- Avg merge
- 4h 39m
- Merged PRs (30d)
- 2
Description
When the logouttype is iframe (didn't test traditional), and I try to abort consent while i am also already logged onto a different service, instead of the standard core/logout-iframe i get the error
SimpleSAML\Error\Error: UNHANDLEDEXCEPTION
Backtrace:
2 src/SimpleSAML/Error/ExceptionHandler.php:47 (SimpleSAML\Error\ExceptionHandler::customExceptionHandler)
1 vendor/symfony/error-handler/ErrorHandler.php:538 (Symfony\Component\ErrorHandler\ErrorHandler::handleException)
0 [builtin] (N/A)
Caused by: TypeError: SimpleSAML\Metadata\MetaDataStorageHandler::getMetaDataConfig(): Argument #1 ($entityId) must be of type string, null given, called in [simplesamlphpdir]/modules/core/src/Controller/Logout.php on line 343
Backtrace:
6 src/SimpleSAML/Metadata/MetaDataStorageHandler.php:372 (SimpleSAML\Metadata\MetaDataStorageHandler::getMetaDataConfig)
5 modules/core/src/Controller/Logout.php:343 (SimpleSAML\Module\core\Controller\Logout::logoutIframe)
4 vendor/symfony/http-kernel/HttpKernel.php:183 (Symfony\Component\HttpKernel\HttpKernel::handleRaw)
3 vendor/symfony/http-kernel/HttpKernel.php:76 (Symfony\Component\HttpKernel\HttpKernel::handle)
2 vendor/symfony/http-kernel/Kernel.php:193 (Symfony\Component\HttpKernel\Kernel::handle)
1 src/SimpleSAML/Module.php:240 (SimpleSAML\Module::process)
0 public/module.php:17 (N/A)
This seems to be because in simplesaml's logout iframe if there's a 'core:TerminatedAssocId' in state it is assumed there's also a 'saml:SPEntityId'
https://github.com/simplesamlphp/simplesamlphp/blob/e5ce356c42789cdd4921e8248d7d2a11b7c159a3/modules/core/src/Controller/Logout.php#L347
this seems to be the case within simplesaml, where the only time core:TerminatedAssocId is set is in receiveLogoutMessage, which is the only time handleLogoutRequest is called with a non-null assocId when SPEntityId is also set
https://github.com/simplesamlphp/simplesamlphp/blob/2a1651b8179b590e064eaa085fdaa3d92a8fc298/modules/saml/src/IdP/SAML2.php#L689-L694
but in the consent module handleLogoutRequest is called with an assocId (stateId) even if saml:SPEntityId is not set in the state
https://github.com/simplesamlphp/simplesamlphp-module-consent/blob/cd6f3b5f345c39ef0b00841b353ddbf086c6dc26/src/Controller/ConsentController.php#L301-L304
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.