From cc83fdcc8ef50a2621e583378243e3720a777871 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Wed, 10 Sep 2025 13:40:27 +0530 Subject: [PATCH] feat: add SLO proc --- enterprise/config/initializers/omniauth_saml.rb | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/enterprise/config/initializers/omniauth_saml.rb b/enterprise/config/initializers/omniauth_saml.rb index f73e3a109..fa440a3eb 100644 --- a/enterprise/config/initializers/omniauth_saml.rb +++ b/enterprise/config/initializers/omniauth_saml.rb @@ -1,5 +1,17 @@ # Enterprise Edition SAML SSO Provider # This initializer adds SAML authentication support for Enterprise customers +# Handle IdP-initiated Single Logout (SLO) session destruction +SAML_SLO_SESSION_DESTROY_PROC = proc do |env, _session| + # Extract user info from SAML logout request + logout_request = env['omniauth.strategy'].response_object + name_id = logout_request.name_id if logout_request.respond_to?(:name_id) + + next unless name_id + + # Find user by email and verify it's a SAML user + user = User.from_email(name_id) + user&.logout_all_sessions! if user&.provider == 'saml' +end # SAML setup proc for multi-tenant configuration SAML_SETUP_PROC = proc do |env| @@ -27,6 +39,7 @@ SAML_SETUP_PROC = proc do |env| env['omniauth.strategy'].options[:idp_sso_service_url] = settings.sso_url env['omniauth.strategy'].options[:idp_cert] = settings.certificate env['omniauth.strategy'].options[:name_identifier_format] = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' + env['omniauth.strategy'].options[:idp_slo_session_destroy] = SAML_SLO_SESSION_DESTROY_PROC else # Set a dummy certificate to avoid the error env['omniauth.strategy'].options[:idp_cert] = 'DUMMY'