search

latchset / mod_auth_mellon

An Apache module with a simple SAML 2.0 service provider
Other
114 stars 49 forks source link

Endpoint "logout/" not handled by mod_auth_mellon. #99

Closed donraikes closed 1 year ago

donraikes commented 2 years ago

I have mod_auth_mellon 0.14 configured in apache 2.4.y7 and have been successful in performing an sp-initiated sso login. When I attempt to logout by accessing: https://phxacrtest.oraclecorp.com/mellon/logout/?ReturnTo=/logout.html

I get a 404 page not found. When I look in the mellon_diagnostics file at the end of the request block of information just prior to the == response == I see: [APLOG_ERR auth_mellon_handler.c:3551] Endpoint "logout/" not handled by mod_auth_mellon.

My sp_metadata.xml file looks like:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<EntityDescriptor
 entityID="https://phxacrtest.oraclecorp.com/mellon/metadata"
 xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
 <SPSSODescriptor
   AuthnRequestsSigned="true"
   WantAssertionsSigned="true"
   protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
   <KeyDescriptor use="signing">
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
       <ds:X509Data>
         <ds:X509Certificate>MIICvDCCAaQCCQDRIF/j7C1rITANBgkqhkiG9w0BAQsFADAgMR4wHAYDVQQDDBVh
Y3JkZXYub3JhY2xlY29ycC5jb20wHhcNMjIwNjIyMjIyNjA5WhcNMzIwNjIxMjIy
NjA5WjAgMR4wHAYDVQQDDBVhY3JkZXYub3JhY2xlY29ycC5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKGLl90UeL+CSb8+7KtlxSUBy87RIlQ2l8
jtzftHsOOOX+L2gZFPPxmj5fP8R2pWJq4rjt06BES8lV2bP7Cn9H+Xu8cqKxsnYl
ArMqZu0StHYSdATx0WDF8Ay3NFdmytOYOK8tYjWt5ZP/zb5FGqKbjh4JdxwZL62C
FsnGYVOubpsu+A7WBZ2lKhZws1kdWmKY+tsFg9veSb4P0L6eprQ1GmVoB4RFSzfM
A1QgnTqbK0cqzNKOFEtQXbSjFkCAtQIHb1wvcByCTjbhT5/RW8y2Vqs+d9pmcN45
9FZ5rX8Jz5iCuA/R1OJeVgeDBC+XKEtQTNLteg/eMsumWde7XVFNAgMBAAEwDQYJ
KoZIhvcNAQELBQADggEBAATelS0+K50iIzj3LB0U/3zU+ASfVEZmGKE9C0LqrQph
8nqmb6MkbnrwcYfY6qsgDlmukWzv5p6K9FgD/CzN78wnoGazFpjFo2t1HszUJPj8
PEcoS8ry92MWkA4WV+R2lZ2y0fDrlqHBY9I27d30I+WokiLoVcfaMfOnC6sdovV8
+zkvyEzqFwSxZ66EDKR0Zg2ksVrrl+QSeAAacUNRKl8ePYHmraBwYIdFzTdZtz/u
TGKeRlNCO7Fqpx343h007ynzkTq0ZePiJVT2jAMkWqx66JeUno08omCrcAq4mZxw
cqN27U4MmNcNITE0C2l9rJDP7lAXcla/DN2V/mH5iD4=</ds:X509Certificate>
       </ds:X509Data>
     </ds:KeyInfo>
   </KeyDescriptor>
   <KeyDescriptor use="encryption">
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
       <ds:X509Data>
         <ds:X509Certificate>MIICvDCCAaQCCQDRIF/j7C1rITANBgkqhkiG9w0BAQsFADAgMR4wHAYDVQQDDBVh
Y3JkZXYub3JhY2xlY29ycC5jb20wHhcNMjIwNjIyMjIyNjA5WhcNMzIwNjIxMjIy
NjA5WjAgMR4wHAYDVQQDDBVhY3JkZXYub3JhY2xlY29ycC5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKGLl90UeL+CSb8+7KtlxSUBy87RIlQ2l8
jtzftHsOOOX+L2gZFPPxmj5fP8R2pWJq4rjt06BES8lV2bP7Cn9H+Xu8cqKxsnYl
ArMqZu0StHYSdATx0WDF8Ay3NFdmytOYOK8tYjWt5ZP/zb5FGqKbjh4JdxwZL62C
FsnGYVOubpsu+A7WBZ2lKhZws1kdWmKY+tsFg9veSb4P0L6eprQ1GmVoB4RFSzfM
A1QgnTqbK0cqzNKOFEtQXbSjFkCAtQIHb1wvcByCTjbhT5/RW8y2Vqs+d9pmcN45
9FZ5rX8Jz5iCuA/R1OJeVgeDBC+XKEtQTNLteg/eMsumWde7XVFNAgMBAAEwDQYJ
KoZIhvcNAQELBQADggEBAATelS0+K50iIzj3LB0U/3zU+ASfVEZmGKE9C0LqrQph
8nqmb6MkbnrwcYfY6qsgDlmukWzv5p6K9FgD/CzN78wnoGazFpjFo2t1HszUJPj8
PEcoS8ry92MWkA4WV+R2lZ2y0fDrlqHBY9I27d30I+WokiLoVcfaMfOnC6sdovV8
+zkvyEzqFwSxZ66EDKR0Zg2ksVrrl+QSeAAacUNRKl8ePYHmraBwYIdFzTdZtz/u
TGKeRlNCO7Fqpx343h007ynzkTq0ZePiJVT2jAMkWqx66JeUno08omCrcAq4mZxw
cqN27U4MmNcNITE0C2l9rJDP7lAXcla/DN2V/mH5iD4=</ds:X509Certificate>
       </ds:X509Data>
     </ds:KeyInfo>
   </KeyDescriptor>
   <SingleLogoutService
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
     Location="https://phxacrtest.oraclecorp.com/mellon/logout" />
   <SingleLogoutService
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
     Location="https://phxacrtest.oraclecorp.com/mellon/logout" />
   <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
   <AssertionConsumerService
     index="0"
     isDefault="true"
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
     Location="https://phxacrtest.oraclecorp.com/mellon/postResponse" />
   <AssertionConsumerService
     index="1"
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
     Location="https://phxacrtest.oraclecorp.com/mellon/artifactResponse" />
   <AssertionConsumerService
     index="2"
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
     Location="https://phxacrtest.oraclecorp.com/mellon/paosResponse" />
 </SPSSODescriptor>
</EntityDescriptor>

I need to enable logout functionality for my application which will log the user out of the sso server along with logging the user out of my application.

liedekef commented 2 years ago

I would say to drop the "/" after "logout", so change it to: https://phxacrtest.oraclecorp.com/mellon/logout?ReturnTo=/logout.html