bbalet / jorani

Leave and Overtime Management System
http://jorani.org/
GNU Affero General Public License v3.0
389 stars 276 forks source link

SAML logout issue with Google Workspace #404

Open atantot opened 11 months ago

atantot commented 11 months ago

Hello,

I'm running into an issue when configuring SAML (with Google Workspace) in Jorani. It works fine except the logout which does not seem to have any effect (which could make sense since I didn't manage to configure it).

Versions

SAML configuration

    'sp' => array(
        'entityId' => base_url() . 'api/metadata',
        'assertionConsumerService' => array(
            'url' => base_url() . 'api/acs',
        ),
        'singleLogoutService' => array(
            'url' => base_url() . 'api/sls',
        ),
        'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
    ),
    'idp' => array(
        'entityId' => 'https://accounts.google.com/o/saml2?idpid=xxxxx',
        'singleSignOnService' => array(
            'url' => 'https://accounts.google.com/o/saml2/idp?idpid=xxxxx',
        ),
        'singleLogoutService' => array(
            'url' => '',
        ),
        'x509cert' => 'xxxyyyzzz',
    ),

Current behavior

  1. In Jorani : after logging in, I choose to log out using the upper right button.
  2. When going back to the base url (jorani.mysite.com), it is still logged in and it does not request again to connect using Google Account.

Expected behavior

After logging out of Jorani, I would expect it to request again to connect using Google Account. Should the SAML config file be set up differently? Do you know any way that I could fix this issue or a workaround?

Note

This issue seems similar to this post here