SAML backend does not support single logout

[dalleng]

Currently I'm using custom backend and identity provider classes to add SLO to my Django app, but wondering if it this could be a useful contribution to the project. Here's a snippet of what I'm using.

from social_core.backends.saml import SAMLAuth, SAMLIdentityProvider

class CustomSAMLAuth(SAMLAuth):

    def get_slo_url(self, idp_name, social_auth, return_to=None):
        idp = self.get_idp(idp_name)
        auth = self._create_saml_auth(idp)
        name_id = social_auth.extra_data['name_id']
        session_index = social_auth.extra_data['session_index']
        return auth.logout(name_id=name_id, session_index=session_index, return_to=return_to)

    def process_logout(self, idp_name, delete_session_cb):
        idp = self.get_idp(idp_name)
        auth = self._create_saml_auth(idp)
        url = auth.process_slo(delete_session_cb=delete_session_cb)
        errors = auth.get_errors()
        return url, errors

    def extra_data(self, user, uid, response, details=None, *args, **kwargs):
        extra_data = super().extra_data(
            user, uid, response, details=details, *args, **kwargs)
        extra_data['session_index'] = response['session_index']
        extra_data['name_id'] = response['attributes']['name_id']
        return extra_data


class CustomIdentityProvider(SAMLIdentityProvider):

    def __init__(self, name, **kwargs):
        super().__init__(name, **kwargs)

    @property
    def slo_url(self):
        """Get the SLO URL for this IdP"""
        return self.conf.get('slo_url')

    @property
    def saml_config_dict(self):
        """Get the IdP configuration dict in the format required by
        python-saml"""
        config = SAMLIdentityProvider.saml_config_dict.fget(self)
        if self.slo_url:
            config.update({
                "singleLogoutService": {
                    "url": self.slo_url,
                    "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                },
            })
        return config

[quique]

Could some contributor please take a look at this code?

This would be a useful feature.

[jpatel3]

Can someone provide more information on this one. I tried to configure slo_url provided by IDP, but when the request comes for logout, it goes thru process_response with destination url /complete/saml/, is that correct? I believe it should go to process_logout.

Any help on how to configure it is appreciated.