Bug 40973

Summary: Redirect to configurable destination after Shibboleth logout
Product: Koha Reporter: Magnus Enger <magnus>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dpavlin
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Magnus Enger 2025-10-08 12:58:20 UTC
We have a scenario where we have disabled OpacPublic, and set OPACShibOnly = Don't allow. This means that when users visit the OPAC they are immediately sent to the idP for login. This works great. The problem is when they try to logout, because after logging out they are sent back to the OPAC, where they are automatically logged in again, if they are still logg in to the idP. This means users can be caught in a loop, with no possibility of getting logged out of Koha.

This is the code in C4::Auth_with_shibboleth that returns users to the OPAC after logout: 

# Logout from Shibboleth
sub logout_shib {
    my ($query) = @_;
    my $uri = _get_uri();
    my $return = _get_return($query);
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" );
}

(_get_uri basically returns staffClientBaseURL or OPACBaseURL, as appropriate)

To get around this we would like to propose that logout_shib could() send users to a configurable location, outside of Koha, based on a syspref. Something like this: 

# Logout from Shibboleth
sub logout_shib {
    my ($query) = @_;
    my $uri = _get_uri();
    my $return;
    if ( C4::Context->preference('ShibRedirectURLAfterLogout') ) {
        $return = C4::Context->preference('ShibRedirectURLAfterLogout');
    } else {
        $return = _get_return($query);
    }
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" );
}
Comment 1 Magnus Enger 2025-10-08 13:03:12 UTC
* logout_shib() could
Comment 2 Magnus Enger 2025-10-08 13:04:03 UTC
I had a quick look at Bug 40596 but as far as I can see it will not conflict with what we suggest.