Bug 40973 - Redirect to configurable destination after Shibboleth logout
Summary: Redirect to configurable destination after Shibboleth logout
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-10-08 12:58 UTC by Magnus Enger
Modified: 2025-10-08 13:04 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Enger 2025-10-08 12:58:20 UTC
We have a scenario where we have disabled OpacPublic, and set OPACShibOnly = Don't allow. This means that when users visit the OPAC they are immediately sent to the idP for login. This works great. The problem is when they try to logout, because after logging out they are sent back to the OPAC, where they are automatically logged in again, if they are still logg in to the idP. This means users can be caught in a loop, with no possibility of getting logged out of Koha.

This is the code in C4::Auth_with_shibboleth that returns users to the OPAC after logout: 

# Logout from Shibboleth
sub logout_shib {
    my ($query) = @_;
    my $uri = _get_uri();
    my $return = _get_return($query);
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" );
}

(_get_uri basically returns staffClientBaseURL or OPACBaseURL, as appropriate)

To get around this we would like to propose that logout_shib could() send users to a configurable location, outside of Koha, based on a syspref. Something like this: 

# Logout from Shibboleth
sub logout_shib {
    my ($query) = @_;
    my $uri = _get_uri();
    my $return;
    if ( C4::Context->preference('ShibRedirectURLAfterLogout') ) {
        $return = C4::Context->preference('ShibRedirectURLAfterLogout');
    } else {
        $return = _get_return($query);
    }
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" );
}
Comment 1 Magnus Enger 2025-10-08 13:03:12 UTC
* logout_shib() could
Comment 2 Magnus Enger 2025-10-08 13:04:03 UTC
I had a quick look at Bug 40596 but as far as I can see it will not conflict with what we suggest.