simplesamlphp / simplesamlphp/simplesamlphp
Single Logout should be propagated from SP to IdP
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 1.1k
- Forks
- 704
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 4
Description
SimplSAMLphp, when used as a proxy, does not properly propagate SLO requests from upstream Identity Providers. Received on it's SP endpoint they will simply terminate the SP session.
So in a given setup:
A SLO Request from a Our SP will be propagated to the Their SPs, but a SLO Request from a Their SP will not be propagated to the Our SPs.
See: https://groups.google.com/forum/#!topic/simplesamlphp/4Bm42hYfGjI
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how an SLO request received on the SP endpoint is handled when SimpleSAMLphp acts as a proxy, using the federation diagram and linked discussion for the expected flow. Done means an SLO request from an upstream IdP is propagated to the downstream IdP rather than only terminating the local SP session.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100