Bug 18046

Summary: Problem with redirect on logout with CAS
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: AuthenticationAssignee: Chris Cormack <chris>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: critical    
Priority: P5 - low CC: chris, dpavlin, fridolin.somers, m.de.rooy
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 17481    
Bug Blocks:    
Attachments: Bug 18046 CAS logout infinite redirect
[SIGNED OFF] Bug 18046 CAS logout infinite redirect
Bug 18046 CAS logout infinite redirect

Description Katrin Fischer 2017-02-03 10:49:58 UTC
Since updating to 3.22.14 which includes the fix for bug 17841, there is a problem when logging out of the OPAC with CAS.

Settings:
casLogout = Logout

Before the update, you weren't redirected back to the OPAC after logout. Bug 17841 was supposed to fix this behaviour.

After the update, we are sending the redirect URL in the service parameter of the logout URL:
https://.../logout?url=https%3A%2F%2F...%2Fcgi-bin%2Fkoha%2Fopac-main.pl%3Flogout.x%3D1

The CAS logout itself works, but the redirect to Koha seems to be stuck in an "infinite loop". The page reloads again and again.

It seems to work ok, when you craft an URL like:
https://.../logout?url=https%3A%2F%2F...%2Fcgi-bin%2Fkoha%2Fopac-main.pl%3Flogout.x%3D1
without the logout.x%3D1 parameter at the end of the URL.

Tested in Firefox ESR 45.7.0.
Comment 1 Katrin Fischer 2017-02-03 13:12:47 UTC
Sorry, had the wrong bug number: bug 17481 was the change that changed things...
Comment 2 Katrin Fischer 2017-02-24 11:56:44 UTC
Upping severity a bit as this is a problem for end users in the OPAC and it looks like Koha is killing the browser.

We fixed it temporarily by removing the logout.x=1 from the URL used for redirecting on logout:

sub logout_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
+    $uri =~ s/\?logout\.x=1//;
    print $query->redirect( $cas->logout_url(url => $uri));
}
Comment 3 Chris Cormack 2017-08-01 22:14:12 UTC
Ah yes, because opac-main.pl looks for the existence of the logout param it will just log them out again and again and again.

So your fix is the right fix.

I will attach a patch here soon
Comment 4 Chris Cormack 2017-08-20 22:43:57 UTC
Created attachment 66254 [details] [review]
Bug 18046 CAS logout infinite redirect

To test (You need a CAS server and CAS configured in Koha)

1/ Login using CAS in Koha
2/ Logout in Koha
3/ Notice you get redirected again and again
4/ Apply patch
5/ Login with CAS, then logout
6/ Notice logout works, but no longer infinitely redirected
Comment 5 Katrin Fischer 2017-08-21 15:13:23 UTC
Created attachment 66282 [details] [review]
[SIGNED OFF] Bug 18046 CAS logout infinite redirect

To test (You need a CAS server and CAS configured in Koha)

1/ Login using CAS in Koha
2/ Logout in Koha
3/ Notice you get redirected again and again
4/ Apply patch
5/ Login with CAS, then logout
6/ Notice logout works, but no longer infinitely redirected

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Patch has been in production use for several months
on several instances. Fixes a critical bug.
Comment 6 Marcel de Rooy 2017-08-25 07:04:18 UTC
Created attachment 66456 [details] [review]
Bug 18046 CAS logout infinite redirect

To test (You need a CAS server and CAS configured in Koha)

1/ Login using CAS in Koha
2/ Logout in Koha
3/ Notice you get redirected again and again
4/ Apply patch
5/ Login with CAS, then logout
6/ Notice logout works, but no longer infinitely redirected

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Patch has been in production use for several months
on several instances. Fixes a critical bug.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Looks like a typical workaround, but evidently works.
Not tested with CAS.
Comment 7 Jonathan Druart 2017-08-25 14:00:49 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 8 Fridolin Somers 2017-09-12 14:14:06 UTC
Pushed to 17.05.x, will be in 17.05.04.
Comment 9 Katrin Fischer 2017-09-15 22:45:06 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.