SAML SLS Logout not working, signature validation failed

[whentotrade]

Describe the bug
SAML Login workflow is working fine with configuration. However, SLS logout service failes on the bookstack SP with error message

"Invalid SLS Response: invalid_logout_response" with text
"Signature validation failed. Logout Response rejected."

The logout workflow works on the IdP as the user is logged out in the primary IdP environment. However, the HTTP-redirect binding for SO by bookstack delivers the error above. As result, the user is never logged out from bookstack, while correctly logged out at the other app by the IdP.

What is missing here? It looks like a missing signature which need to be set somewhere? But I cant see any additional options to configure the SAML processing via the env file. Is this related to the issue reported #1926 ?

Expected behavior
User should be logged out of the bookstack instance via the SAML SLS HTTP-redirect. As login is working and as the logout is processed correctly by the IdM provider app.

Additional context
#1926

[babington-andy]

I'm experiencing the same issue, which IDP are you using?

I'm using Azure AD and when investigating the SAML logout response and attempting to validate it using https://www.samltool.com/validate_logout_res.php I get the same error message, so it appears that (at least in my case) the IDP is to blame because it's incorrectly signing the response. I could be wrong about that though, happy to be corrected.

[whentotrade]

@babington-andy I am using a wordpess plugin as IdP - which works great with other SPs. Just the logout flow with bookstack is giving this error. I how no solution until now..

[deano2point0]

I am receiving the same Error message using Azure AD as my idP. Been trying to solve it without any success.

[jimmyc802]

Also experiencing this. Eventually the authentication session expires on Bookstack but its concerning that the Logout button does not actually log you out of Bookstack with SAML enabled.

[ehv1]

I expierenced the same problem, but also found a way to fix this.

Please take a look here:
https://stackoverflow.com/questions/41894290/centrify-azure-as-idp-does-not-return-logoutresponse-on-single-log-out

[snip]
UPDATE regarding Azure

If you are using the Onelogin PHP Toolkit, then you also have to enable the 'retrieveParametersFromServer'-Setting, otherwise the logout response will always end up with a 'Signature validation failed. Logout Request rejected' error.
[/snip]

So the solution is to change the third parameter from false to true in the $toolkit->processSLO function in class BookStack\Auth\Access\Saml2Service:

/**
 * Process a response for the single logout service.
 * @throws Error
 */
public function processSlsResponse(?string $requestId): ?string
{
    $toolkit = $this->getToolkit();
    $redirect = $toolkit->processSLO(true, $requestId, true, null, true);

    $errors = $toolkit->getErrors();
	
    if (!empty($errors)) {
        throw new Error(
            'Invalid SLS Response: '.implode(', ', $errors)
        );
    }

    $this->actionLogout();
    return $redirect;
}

Eventually this will lead to the function OneLogin\Saml2\Utils::validateBinarySign being called with the 4th parameter $retrieveParametersFromServer to be true instead of false.
According to the function description this parameter indicates where to get the values in order to validate the Sign, from getData or from $_SERVER.

So in case of Azure, this needs to be truthy and fetched from $_SERVER['QUERY_STRING'].

I just tested it and it works like a charm!

[justarandomsysadmin]

I just tested it and it works like a charm!

I can not confirm that. I'm also using Azure and had experienced the logout error from the title. When I switch that parameter from false to true I just get an Azure Error instead of that bookstack error (and I'm still logged in).

AADSTS50068: Signout failed. The initiating application is not a participant in the current session.

[ssddanbrown]

As per #2902, and issue #1925, a range of changes have now been made for BookStack v21.10.

The new SAML2_SP_x509 and SAML2_SP_x509_KEY options, which enable SP SLS signing, can be seen in the updated documentation:
https://www.bookstackapp.com/docs/admin/saml2-auth/
For ADFS usage, these will need to be set with a service provider certificate and key, with the certificate also added on the ADFS side for SLS request signing.

Will therefore close this off but please open a new issue if there are problems with the updated implementation.