Bug 41312

Summary: Don't redirect to logout after Shibboleth login
Product: Koha Reporter: Magnus Enger <magnus>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: dpavlin
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34164
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Magnus Enger 2025-11-26 14:02:50 UTC
When Shibboleth is enabled, a link with the text "Log in using a Shibboleth account" is presented above the regular login form. The destination of the link varies based on the URL of the login page: 

If you start on https://example.org/ the link is: 
https://example.org/Shibboleth.sso/Login?target=https://example.org/cgi-bin/koha/mainpage.pl

If you start on https://example.org/cgi-bin/koha/catalogue/detail.pl?biblionumber=1 the link is: 
https://example.org/Shibboleth.sso/Login?target=https://example.org/cgi-bin/koha/catalogue/detail.pl%3Fbiblionumber%3D1

And if you just logged out and then want to log in again, you will start on https://example.org/cgi-bin/koha/mainpage.pl?logout.x=1 and the link will be: 
https://example.org/Shibboleth.sso/Login?target=https://example.org/cgi-bin/koha/mainpage.pl%3Flogout.x%3D1
But this means that the user is logged out immediately after logging in, which is less than optimal. We should identify when this happens and manipulate the URL so it does not include the logout.x=1 part. 

A similar problem for OAuth/OIDC was solved in bug 34164.