DonutsNL / glpisaml

I moved to: https://codeberg.org/QuinQuies This plugin is a full rewrite of Derrick Smith's initial SAML plugin for GLPI10+. Its redesigned to be compatible with GLPI10+, PSR, Composer, Support multiple saml idp's, user right rules and more.
https://discord.gg/yKZB7VQUk6
GNU General Public License v3.0
10 stars 0 forks source link

Login errors caused by inconsistent session database due to logout not yet implemented. #17

Open DonutsNL opened 3 months ago

DonutsNL commented 3 months ago

The logout is not yet fully implemented. plugin currently depends on GLPI default logout functionality but does not log the user out of the IDP. Clicking the login button will simply log the user back in using the existing IDP session. In addition the sessions are not registered correctly in the GLPISAML session database that keeps track of all active sessions. Because of the logout action is not yet properly administrated, the cross checking functions of the plugin might fail because the sessions can get into an inconsistant state. This might lead to login errors like 'did not expect saml response from this IDP' on login.

Work arround if this occurs is to close all browsers and start over.