Bug 41312 - Don't redirect to logout after Shibboleth login
Summary: Don't redirect to logout after Shibboleth login
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-11-26 14:02 UTC by Magnus Enger
Modified: 2025-11-26 14:03 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Enger 2025-11-26 14:02:50 UTC
When Shibboleth is enabled, a link with the text "Log in using a Shibboleth account" is presented above the regular login form. The destination of the link varies based on the URL of the login page: 

If you start on https://example.org/ the link is: 
https://example.org/Shibboleth.sso/Login?target=https://example.org/cgi-bin/koha/mainpage.pl

If you start on https://example.org/cgi-bin/koha/catalogue/detail.pl?biblionumber=1 the link is: 
https://example.org/Shibboleth.sso/Login?target=https://example.org/cgi-bin/koha/catalogue/detail.pl%3Fbiblionumber%3D1

And if you just logged out and then want to log in again, you will start on https://example.org/cgi-bin/koha/mainpage.pl?logout.x=1 and the link will be: 
https://example.org/Shibboleth.sso/Login?target=https://example.org/cgi-bin/koha/mainpage.pl%3Flogout.x%3D1
But this means that the user is logged out immediately after logging in, which is less than optimal. We should identify when this happens and manipulate the URL so it does not include the logout.x=1 part. 

A similar problem for OAuth/OIDC was solved in bug 34164.