Bug 18046 - Problem with redirect on logout with CAS
Summary: Problem with redirect on logout with CAS
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low critical (vote)
Assignee: Chris Cormack
QA Contact: Marcel de Rooy
URL:
Whiteboard:
Keywords:
Depends on: 17481
Blocks:
  Show dependency treegraph
 
Reported: 2017-02-03 10:49 UTC by Katrin Fischer
Modified: 2017-09-15 22:45 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 18046 CAS logout infinite redirect (1.02 KB, patch)
2017-08-20 22:43 UTC, Chris Cormack
Details | Diff | Splinter Review
[SIGNED OFF] Bug 18046 CAS logout infinite redirect (1.17 KB, patch)
2017-08-21 15:13 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 18046 CAS logout infinite redirect (1.33 KB, patch)
2017-08-25 07:04 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2017-02-03 10:49:58 UTC
Since updating to 3.22.14 which includes the fix for bug 17841, there is a problem when logging out of the OPAC with CAS.

Settings:
casLogout = Logout

Before the update, you weren't redirected back to the OPAC after logout. Bug 17841 was supposed to fix this behaviour.

After the update, we are sending the redirect URL in the service parameter of the logout URL:
https://.../logout?url=https%3A%2F%2F...%2Fcgi-bin%2Fkoha%2Fopac-main.pl%3Flogout.x%3D1

The CAS logout itself works, but the redirect to Koha seems to be stuck in an "infinite loop". The page reloads again and again.

It seems to work ok, when you craft an URL like:
https://.../logout?url=https%3A%2F%2F...%2Fcgi-bin%2Fkoha%2Fopac-main.pl%3Flogout.x%3D1
without the logout.x%3D1 parameter at the end of the URL.

Tested in Firefox ESR 45.7.0.
Comment 1 Katrin Fischer 2017-02-03 13:12:47 UTC
Sorry, had the wrong bug number: bug 17481 was the change that changed things...
Comment 2 Katrin Fischer 2017-02-24 11:56:44 UTC
Upping severity a bit as this is a problem for end users in the OPAC and it looks like Koha is killing the browser.

We fixed it temporarily by removing the logout.x=1 from the URL used for redirecting on logout:

sub logout_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
+    $uri =~ s/\?logout\.x=1//;
    print $query->redirect( $cas->logout_url(url => $uri));
}
Comment 3 Chris Cormack 2017-08-01 22:14:12 UTC
Ah yes, because opac-main.pl looks for the existence of the logout param it will just log them out again and again and again.

So your fix is the right fix.

I will attach a patch here soon
Comment 4 Chris Cormack 2017-08-20 22:43:57 UTC
Created attachment 66254 [details] [review]
Bug 18046 CAS logout infinite redirect

To test (You need a CAS server and CAS configured in Koha)

1/ Login using CAS in Koha
2/ Logout in Koha
3/ Notice you get redirected again and again
4/ Apply patch
5/ Login with CAS, then logout
6/ Notice logout works, but no longer infinitely redirected
Comment 5 Katrin Fischer 2017-08-21 15:13:23 UTC
Created attachment 66282 [details] [review]
[SIGNED OFF] Bug 18046 CAS logout infinite redirect

To test (You need a CAS server and CAS configured in Koha)

1/ Login using CAS in Koha
2/ Logout in Koha
3/ Notice you get redirected again and again
4/ Apply patch
5/ Login with CAS, then logout
6/ Notice logout works, but no longer infinitely redirected

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Patch has been in production use for several months
on several instances. Fixes a critical bug.
Comment 6 Marcel de Rooy 2017-08-25 07:04:18 UTC
Created attachment 66456 [details] [review]
Bug 18046 CAS logout infinite redirect

To test (You need a CAS server and CAS configured in Koha)

1/ Login using CAS in Koha
2/ Logout in Koha
3/ Notice you get redirected again and again
4/ Apply patch
5/ Login with CAS, then logout
6/ Notice logout works, but no longer infinitely redirected

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Patch has been in production use for several months
on several instances. Fixes a critical bug.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Looks like a typical workaround, but evidently works.
Not tested with CAS.
Comment 7 Jonathan Druart 2017-08-25 14:00:49 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 8 Fridolin SOMERS 2017-09-12 14:14:06 UTC
Pushed to 17.05.x, will be in 17.05.04.
Comment 9 Katrin Fischer 2017-09-15 22:45:06 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.