simplesamlphp / simplesamlphp/simplesamlphp-module-consent

Logout fails because SPEntityID is not in state

Ouverte
#56 2 commentaires 0 réactions 1 personne assignée Voir sur GitHub

@monkeyiq y travaille déjà.

Depuis le 14/7/2026.

Langage dominant
PHP
Étoiles
4
Forks
7
Merge moyen
4 h 39 min
PR mergées (30 j)
2

Description

When the logouttype is iframe (didn't test traditional), and I try to abort consent while i am also already logged onto a different service, instead of the standard core/logout-iframe i get the error

SimpleSAML\Error\Error: UNHANDLEDEXCEPTION

Backtrace:
2 src/SimpleSAML/Error/ExceptionHandler.php:47 (SimpleSAML\Error\ExceptionHandler::customExceptionHandler)
1 vendor/symfony/error-handler/ErrorHandler.php:538 (Symfony\Component\ErrorHandler\ErrorHandler::handleException)
0 [builtin] (N/A)
Caused by: TypeError: SimpleSAML\Metadata\MetaDataStorageHandler::getMetaDataConfig(): Argument #1 ($entityId) must be of type string, null given, called in [simplesamlphpdir]/modules/core/src/Controller/Logout.php on line 343
Backtrace:
6 src/SimpleSAML/Metadata/MetaDataStorageHandler.php:372 (SimpleSAML\Metadata\MetaDataStorageHandler::getMetaDataConfig)
5 modules/core/src/Controller/Logout.php:343 (SimpleSAML\Module\core\Controller\Logout::logoutIframe)
4 vendor/symfony/http-kernel/HttpKernel.php:183 (Symfony\Component\HttpKernel\HttpKernel::handleRaw)
3 vendor/symfony/http-kernel/HttpKernel.php:76 (Symfony\Component\HttpKernel\HttpKernel::handle)
2 vendor/symfony/http-kernel/Kernel.php:193 (Symfony\Component\HttpKernel\Kernel::handle)
1 src/SimpleSAML/Module.php:240 (SimpleSAML\Module::process)
0 public/module.php:17 (N/A)

This seems to be because in simplesaml's logout iframe if there's a 'core:TerminatedAssocId' in state it is assumed there's also a 'saml:SPEntityId'
https://github.com/simplesamlphp/simplesamlphp/blob/e5ce356c42789cdd4921e8248d7d2a11b7c159a3/modules/core/src/Controller/Logout.php#L347
this seems to be the case within simplesaml, where the only time core:TerminatedAssocId is set is in receiveLogoutMessage, which is the only time handleLogoutRequest is called with a non-null assocId when SPEntityId is also set
https://github.com/simplesamlphp/simplesamlphp/blob/2a1651b8179b590e064eaa085fdaa3d92a8fc298/modules/saml/src/IdP/SAML2.php#L689-L694
but in the consent module handleLogoutRequest is called with an assocId (stateId) even if saml:SPEntityId is not set in the state
https://github.com/simplesamlphp/simplesamlphp-module-consent/blob/cd6f3b5f345c39ef0b00841b353ddbf086c6dc26/src/Controller/ConsentController.php#L301-L304

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.