Hi there, we have the following setup: Official Discourse 2.5.0 ([ 3f7658cc6e ]) with the discourse-saml plugin (commit 230a58b), Keycloak (10.0.2) as Identity Provider Our Identity Provider is set up to use the url https://discourse.our-domain.xxx/auth/saml/slo as Logout Service POST Binding URL. Our login process works flawless. Using the logout button in discourse cancels our IdP session too. The problem exists when using the logout functionality of the IdP. Discourse does not cancel the session. The forum receives the request, but does not seem to handle it properly. The user stays logged in and we get an error in the discourse log. The username for the following logs is test. Started POST "/auth/saml/slo" for 127.0.0.1 at 2020-07-09 18:29:33 +0000 OmniAuth::Strategies::SAML::ValidationError (SAML failed to process LogoutRequest) /var/www/discourse/plugins/discourse-saml/gems/2.6.6/gems/omniauth-saml-1.9.0/lib/omniauth/strategies/saml.rb:189:in `handle_logout_request' The if condition leading to the exception is the following (saml.rb): if logout_request.is_valid? && logout_request.name_id == session["saml_uid"] code for debug out STDERR.puts '*************************************************************************' STDERR.puts 'raw_request:' STDERR.puts raw_request STDERR.puts '*************************************************************************' STDERR.puts 'logout_request.is_valid?' STDERR.puts logout_request.is_valid? STDERR.puts '*************************************************************************' STDERR.puts 'logout_request.name_id' STDERR.puts logout_request.name_id STDERR.puts '*************************************************************************' STDERR.puts 'session[saml_uid]' STDERR.puts session["saml_uid"] STDERR.puts '*************************************************************************' We added the debug output in the saml.rb (line 181) and received the following values: ************************************************************************* raw_request: raw request (decoded with base64) https://ima.test.our-domain.xxx/auth/realms/master nbeIwX97u+NNRf4KswI95oSmI2w= [...] [...] [...] [...] AQAB test 393fc3ab-6a18-4b8e-89a5-a005fc48f7cf::36a71dc0-22a0-4b72-be02-68639bedea06 ************************************************************************* logout_request.is_valid? true ************************************************************************* logout_request.name_id test ************************************************************************* session[saml_uid] ************************************************************************* Can anybody help us? It does not seem like a configuration problem to us. Thanks in advance Max

We’re not handling the saml_uid session value in our plugin. It’s handled by the omniauth-saml gem itself. So I’m not sure about why you have an empty value in session["saml_uid"]. You may need to report the issue in omniauth gem. Also, none of the customers have reported an issue in SLO yet.

I have recognized the same thing: 2 applications (discourse and another one. lets name it X) connected to keycloak with SAML. Logout on discourse. The user is also logged out on X and can’t do anything there. Logout on X. The session on keycloak is gone but the user stays online in discourse Even a browser page reload on discourse does not validate, that the saml auth is gone (= user is logged out). I would expect that the user is logged out on discourse, too. Does discourse check the saml auth on keycloak? When will it do that?

Discourse-saml: SLO does not cancel session

תמיכה

sbernhard (Bernhard Suttner) 17 במרץ,‏ 2021,‏ 7:45am 4

Would it be possible to validate if the saml session is still alive? See answer above @vinothkannans

נושא		תגובות	צפיות
Discourse SAML logout issue SSO	0	783	25 בנובמבר,‏ 2020
IdP-Initiated SLO logout is not working SSO	1	653	18 בספטמבר,‏ 2023
Keycloak SSO and logout Product Support	0	772	28 בינואר,‏ 2021
SAML is creating error for local user log out SSO	7	893	25 במאי,‏ 2023
SAML logout stops working Bug auth-plugins , saml , fixed	3	225	16 בספטמבר,‏ 2025

Discourse-saml: SLO does not cancel session

נושאים קשורים