We have a scenario where we have disabled OpacPublic, and set OPACShibOnly = Don't allow. This means that when users visit the OPAC they are immediately sent to the idP for login. This works great. The problem is when they try to logout, because after logging out they are sent back to the OPAC, where they are automatically logged in again, if they are still logg in to the idP. This means users can be caught in a loop, with no possibility of getting logged out of Koha. This is the code in C4::Auth_with_shibboleth that returns users to the OPAC after logout: # Logout from Shibboleth sub logout_shib { my ($query) = @_; my $uri = _get_uri(); my $return = _get_return($query); print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" ); } (_get_uri basically returns staffClientBaseURL or OPACBaseURL, as appropriate) To get around this we would like to propose that logout_shib could() send users to a configurable location, outside of Koha, based on a syspref. Something like this: # Logout from Shibboleth sub logout_shib { my ($query) = @_; my $uri = _get_uri(); my $return; if ( C4::Context->preference('ShibRedirectURLAfterLogout') ) { $return = C4::Context->preference('ShibRedirectURLAfterLogout'); } else { $return = _get_return($query); } print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" ); }
* logout_shib() could
I had a quick look at Bug 40596 but as far as I can see it will not conflict with what we suggest.