Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not confuse Settings::getIdPSLOResponseUrl() with bad example #608

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

RoSk0
Copy link

@RoSk0 RoSk0 commented Jan 30, 2025

When IdP configuration has the responseUrl set to an empty string, as it is currently in the example config file, during the single log out flow when LogoutRequest is received, that could lead to the attempt to respond to the IdP using a RelayState value, rather than singleLogoutService.url value, because unlike Settings::checkIdPSettings(), Settings::getIdPSLOResponseUrl() only checks if responseUrl isset() like is it demonstrated here https://3v4l.org/VhEdl .

In my opinion, Settings::checkIdPSettings() should be improved to error on an empty string in the responseUrl value which is implemented in a separate commit.

@RoSk0
Copy link
Author

RoSk0 commented Jan 30, 2025

I've checked the failures and both cases appear legitimate to me, if I understand this correctly, and suggest that \OneLogin_Saml_Settings::$idpSingleLogOutUrl should be made nullable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant