feat: add SLO proc

enterprise/config/initializers/omniauth_saml.rb

@@ -1,5 +1,17 @@
 # Enterprise Edition SAML SSO Provider
 # This initializer adds SAML authentication support for Enterprise customers
+# Handle IdP-initiated Single Logout (SLO) session destruction
+SAML_SLO_SESSION_DESTROY_PROC = proc do |env, _session|
+  # Extract user info from SAML logout request
+  logout_request = env['omniauth.strategy'].response_object
+  name_id = logout_request.name_id if logout_request.respond_to?(:name_id)
+
+  next unless name_id
+
+  # Find user by email and verify it's a SAML user
+  user = User.from_email(name_id)
+  user&.logout_all_sessions! if user&.provider == 'saml'
+end
 
 # SAML setup proc for multi-tenant configuration
 SAML_SETUP_PROC = proc do |env|
@@ -27,6 +39,7 @@ SAML_SETUP_PROC = proc do |env|
       env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url
       env['omniauth.strategy'].options[:idp_cert] = settings.certificate
       env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
+      env['omniauth.strategy'].options[:idp_slo_session_destroy] = SAML_SLO_SESSION_DESTROY_PROC
     else
       # Set a dummy certificate to avoid the error
       env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'