SAML SLO support

go.mod

@@ -261,6 +261,7 @@ require (
 	github.com/proglottis/gpgme v0.1.3 // indirect
 	github.com/rancher/wrangler v1.1.2 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/russellhaering/gosaml2 v0.9.1 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.8.0 // indirect
 	github.com/sigstore/fulcio v1.4.3 // indirect
 	github.com/sigstore/rekor v1.2.2 // indirect
@@ -313,7 +314,7 @@ require (
 	github.com/adrg/xdg v0.4.0 // indirect
 	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/beevik/etree v1.1.0 // indirect
+	github.com/beevik/etree v1.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
@@ -366,7 +367,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jmoiron/sqlx v1.3.5 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
+	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.17.7 // indirect
@@ -411,7 +412,7 @@ require (
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/rs/xid v1.2.1 // indirect
 	github.com/rubenv/sql-migrate v1.5.2 // indirect
-	github.com/russellhaering/goxmldsig v1.3.0 // indirect
+	github.com/russellhaering/goxmldsig v1.4.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
 	github.com/spf13/cast v1.5.1 // indirect

go.sum

@@ -925,8 +925,9 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.28.10 h1:69tpbPED7jKPyzMcrwSvhWcJ9bP
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.10/go.mod h1:0Aqn1MnEuitqfsCNyKsdKLhDUOr4txD/g19EfiUqgws=
 github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
-github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
+github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
+github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
@@ -1507,8 +1508,9 @@ github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
 github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
-github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
+github.com/jonboulle/clockwork v0.3.0 h1:9BSCMi8C+0qdApAp4auwX0RkLGUjs956h0EkuQymUhg=
+github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@@ -1918,8 +1920,11 @@ github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rubenv/sql-migrate v1.5.2 h1:bMDqOnrJVV/6JQgQ/MxOpU+AdO8uzYYA/TxFUBzFtS0=
 github.com/rubenv/sql-migrate v1.5.2/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
-github.com/russellhaering/goxmldsig v1.3.0 h1:DllIWUgMy0cRUMfGiASiYEa35nsieyD3cigIwLonTPM=
+github.com/russellhaering/gosaml2 v0.9.1 h1:H/whrl8NuSoxyW46Ww5lKPskm+5K+qYLw9afqJ/Zef0=
+github.com/russellhaering/gosaml2 v0.9.1/go.mod h1:ja+qgbayxm+0mxBRLMSUuX3COqy+sb0RRhIGun/W2kc=
 github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
+github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
+github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=

pkg/apis/management.cattle.io/v3/authn_types.go

@@ -177,6 +177,7 @@ type AuthConfig struct {
 	Enabled             bool             `json:"enabled,omitempty"`
 	AccessMode          string           `json:"accessMode,omitempty" norman:"required,notnullable,type=enum,options=required|restricted|unrestricted"`
 	AllowedPrincipalIDs []string         `json:"allowedPrincipalIds,omitempty" norman:"type=array[reference[principal]]"`
+	LogoutAllSupported  bool             `json:"logoutAllSupported,omitempty"`
 	Status              AuthConfigStatus `json:"status"`
 }
 
@@ -404,6 +405,8 @@ type FreeIpaTestAndApplyInput struct {
 type SamlConfig struct {
 	AuthConfig `json:",inline" mapstructure:",squash"`
 
+	LogoutAllEnabled   bool   `json:"logoutAllEnabled,omitempty"`
+	LogoutAllForced    bool   `json:"logoutAllForced,omitempty"`
 	IDPMetadataContent string `json:"idpMetadataContent" norman:"required"`
 	SpCert             string `json:"spCert"             norman:"required"`
 	SpKey              string `json:"spKey"              norman:"required,type=password"`
@@ -423,6 +426,14 @@ type SamlConfigTestOutput struct {
 	IdpRedirectURL string `json:"idpRedirectUrl"`
 }
 
+type SamlConfigLogoutInput struct {
+	FinalRedirectURL string `json:"finalRedirectUrl"`
+}
+
+type SamlConfigLogoutOutput struct {
+	IdpRedirectURL string `json:"idpRedirectUrl"`
+}
+
 type PingConfig struct {
 	SamlConfig `json:",inline" mapstructure:",squash"`
 }

pkg/auth/data/authconfig_data.go

@@ -20,66 +20,66 @@ import (
 )
 
 func AuthConfigs(management *config.ManagementContext) error {
-	if err := addAuthConfig(github.Name, client.GithubConfigType, false, management); err != nil {
+	if err := addAuthConfig(github.Name, client.GithubConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(activedirectory.Name, client.ActiveDirectoryConfigType, false, management); err != nil {
+	if err := addAuthConfig(activedirectory.Name, client.ActiveDirectoryConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(azure.Name, client.AzureADConfigType, false, management); err != nil {
+	if err := addAuthConfig(azure.Name, client.AzureADConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(ldap.OpenLdapName, client.OpenLdapConfigType, false, management); err != nil {
+	if err := addAuthConfig(ldap.OpenLdapName, client.OpenLdapConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(ldap.FreeIpaName, client.FreeIpaConfigType, false, management); err != nil {
+	if err := addAuthConfig(ldap.FreeIpaName, client.FreeIpaConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(saml.PingName, client.PingConfigType, false, management); err != nil {
+	if err := addAuthConfig(saml.PingName, client.PingConfigType, false, true, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(saml.ADFSName, client.ADFSConfigType, false, management); err != nil {
+	if err := addAuthConfig(saml.ADFSName, client.ADFSConfigType, false, true, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(saml.KeyCloakName, client.KeyCloakConfigType, false, management); err != nil {
+	if err := addAuthConfig(saml.KeyCloakName, client.KeyCloakConfigType, false, true, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(saml.OKTAName, client.OKTAConfigType, false, management); err != nil {
+	if err := addAuthConfig(saml.OKTAName, client.OKTAConfigType, false, true, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(saml.ShibbolethName, client.ShibbolethConfigType, false, management); err != nil {
+	if err := addAuthConfig(saml.ShibbolethName, client.ShibbolethConfigType, false, true, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(googleoauth.Name, client.GoogleOauthConfigType, false, management); err != nil {
+	if err := addAuthConfig(googleoauth.Name, client.GoogleOauthConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(oidc.Name, client.OIDCConfigType, false, management); err != nil {
+	if err := addAuthConfig(oidc.Name, client.OIDCConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(keycloakoidc.Name, client.KeyCloakOIDCConfigType, false, management); err != nil {
+	if err := addAuthConfig(keycloakoidc.Name, client.KeyCloakOIDCConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	if err := addAuthConfig(genericoidc.Name, client.GenericOIDCConfigType, false, management); err != nil {
+	if err := addAuthConfig(genericoidc.Name, client.GenericOIDCConfigType, false, false, management); err != nil {
 		return err
 	}
 
-	return addAuthConfig(localprovider.Name, client.LocalConfigType, true, management)
+	return addAuthConfig(localprovider.Name, client.LocalConfigType, true, false, management)
 }
 
-func addAuthConfig(name, aType string, enabled bool, management *config.ManagementContext) error {
+func addAuthConfig(name, aType string, enabled, sloSupported bool, management *config.ManagementContext) error {
 	annotations := make(map[string]string)
 	if name == azure.Name {
 		annotations[azure.GraphEndpointMigratedAnnotation] = "true"
@@ -91,8 +91,9 @@ func addAuthConfig(name, aType string, enabled bool, management *config.Manageme
 			Name:        name,
 			Annotations: annotations,
 		},
-		Type:    aType,
-		Enabled: enabled,
+		Type:               aType,
+		Enabled:            enabled,
+		LogoutAllSupported: sloSupported,
 	})
 	if err != nil && !apierrors.IsAlreadyExists(err) {
 		return err

pkg/auth/providers/providers.go

@@ -53,6 +53,9 @@ func Configure(ctx context.Context, mgmt *config.ScaledContext) {
 	defer confMu.Unlock()
 	userMGR := mgmt.UserManager
 	tokenMGR := tokens.NewManager(ctx, mgmt)
+
+	tokens.OnLogoutAll(saml.PerformSamlLogout)
+
 	var p common.AuthProvider
 
 	p = local.Configure(ctx, mgmt, tokenMGR)

pkg/auth/providers/saml/saml_actions.go

@@ -59,10 +59,15 @@ func (s *Provider) testAndEnable(actionName string, action *types.Action, reques
 	}
 
 	logrus.Debugf("SAML [testAndEnable]: Setting clientState for SAML service provider %v", s.name)
+
 	finalRedirectURL := samlLogin.FinalRedirectURL
+	logrus.Debugf("SAML [testAndEnable]: Final redirect will be (%v)", finalRedirectURL)
+
+	provider.clientState.SetPath(provider.serviceProvider.AcsURL.Path)
 	provider.clientState.SetState(request.Response, request.Request, "Rancher_UserID", provider.userMGR.GetUser(request))
 	provider.clientState.SetState(request.Response, request.Request, "Rancher_FinalRedirectURL", finalRedirectURL)
 	provider.clientState.SetState(request.Response, request.Request, "Rancher_Action", testAndEnableAction)
+
 	idpRedirectURL, err := provider.HandleSamlLogin(request.Response, request.Request)
 	if err != nil {
 		return err