simplesamlphp / simplesamlphp/simplesamlphp-module-consent

Logout fails because SPEntityID is not in state

Open
#56 2 comments 0 reactions 1 assignee View on GitHub

@monkeyiq is already working on this.

Since Jul 14, 2026.

Dominant language
PHP
Stars
4
Forks
7
Avg merge
4h 39m
Merged PRs (30d)
2

Description

When the logouttype is iframe (didn't test traditional), and I try to abort consent while i am also already logged onto a different service, instead of the standard core/logout-iframe i get the error

SimpleSAML\Error\Error: UNHANDLEDEXCEPTION

Backtrace:
2 src/SimpleSAML/Error/ExceptionHandler.php:47 (SimpleSAML\Error\ExceptionHandler::customExceptionHandler)
1 vendor/symfony/error-handler/ErrorHandler.php:538 (Symfony\Component\ErrorHandler\ErrorHandler::handleException)
0 [builtin] (N/A)
Caused by: TypeError: SimpleSAML\Metadata\MetaDataStorageHandler::getMetaDataConfig(): Argument #1 ($entityId) must be of type string, null given, called in [simplesamlphpdir]/modules/core/src/Controller/Logout.php on line 343
Backtrace:
6 src/SimpleSAML/Metadata/MetaDataStorageHandler.php:372 (SimpleSAML\Metadata\MetaDataStorageHandler::getMetaDataConfig)
5 modules/core/src/Controller/Logout.php:343 (SimpleSAML\Module\core\Controller\Logout::logoutIframe)
4 vendor/symfony/http-kernel/HttpKernel.php:183 (Symfony\Component\HttpKernel\HttpKernel::handleRaw)
3 vendor/symfony/http-kernel/HttpKernel.php:76 (Symfony\Component\HttpKernel\HttpKernel::handle)
2 vendor/symfony/http-kernel/Kernel.php:193 (Symfony\Component\HttpKernel\Kernel::handle)
1 src/SimpleSAML/Module.php:240 (SimpleSAML\Module::process)
0 public/module.php:17 (N/A)

This seems to be because in simplesaml's logout iframe if there's a 'core:TerminatedAssocId' in state it is assumed there's also a 'saml:SPEntityId'
https://github.com/simplesamlphp/simplesamlphp/blob/e5ce356c42789cdd4921e8248d7d2a11b7c159a3/modules/core/src/Controller/Logout.php#L347
this seems to be the case within simplesaml, where the only time core:TerminatedAssocId is set is in receiveLogoutMessage, which is the only time handleLogoutRequest is called with a non-null assocId when SPEntityId is also set
https://github.com/simplesamlphp/simplesamlphp/blob/2a1651b8179b590e064eaa085fdaa3d92a8fc298/modules/saml/src/IdP/SAML2.php#L689-L694
but in the consent module handleLogoutRequest is called with an assocId (stateId) even if saml:SPEntityId is not set in the state
https://github.com/simplesamlphp/simplesamlphp-module-consent/blob/cd6f3b5f345c39ef0b00841b353ddbf086c6dc26/src/Controller/ConsentController.php#L301-L304

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.