diff --git a/appinfo/routes.php b/appinfo/routes.php index 3676ca5..63e5ca9 100644 --- a/appinfo/routes.php +++ b/appinfo/routes.php @@ -48,6 +48,12 @@ return [ 'url' => '/saml/sls', 'verb' => 'GET', ], + [ + 'name' => 'SAML#singleLogoutService', + 'url' => '/saml/sls', + 'verb' => 'POST', + 'postfix' => 'slspost', + ], [ 'name' => 'SAML#notProvisioned', 'url' => '/saml/notProvisioned', diff --git a/lib/Controller/SAMLController.php b/lib/Controller/SAMLController.php index 50bec66..e289840 100644 --- a/lib/Controller/SAMLController.php +++ b/lib/Controller/SAMLController.php @@ -319,6 +319,13 @@ class SAMLController extends Controller { public function singleLogoutService() { $isFromGS = ($this->config->getSystemValue('gs.enabled', false) && $this->config->getSystemValue('gss.mode', '') === 'master'); + + // Some IDPs send the SLO request via POST, but OneLogin php-saml only handles GET. + // To hack around this issue we copy the request from _POST to _GET. + if(!empty($_POST['SAMLRequest'])) { + $_GET['SAMLRequest'] = $_POST['SAMLRequest']; + } + $isFromIDP = !$isFromGS && !empty($_GET['SAMLRequest']); if($isFromIDP) { diff --git a/tests/unit/AppInfo/RoutesTest.php b/tests/unit/AppInfo/RoutesTest.php index e806fa9..b8e71b0 100644 --- a/tests/unit/AppInfo/RoutesTest.php +++ b/tests/unit/AppInfo/RoutesTest.php @@ -54,6 +54,12 @@ class Test extends TestCase { 'url' => '/saml/sls', 'verb' => 'GET', ], + [ + 'name' => 'SAML#singleLogoutService', + 'url' => '/saml/sls', + 'verb' => 'POST', + 'postfix' => 'slspost', + ], [ 'name' => 'SAML#notProvisioned', 'url' => '/saml/notProvisioned',