SAML logout support

[ara4n]

According to #5130 (comment) we don't support logging out on SAML properly somehow. @slipeer can you elaborate please?

[slipeer]

I'm about Single Logout profile (page 32)
I believe that a synapse should implement SAML logout endpoint in order to revoke user's tokens when SSO logout performed.

[mjattiot]

I have implemented a SAML logout. It's basic but it's working for my company.
I thought it might interest others so I created a pull request : #6414
I am not a SAML expert so it probably need improvement. @richvdh your comments are welcomed.

[oblak-be]

Any progress on this one?

[richvdh]

so that I don't lose them, some links explaining why SLO might not actually be very useful:

• https://communities.surf.nl/en/article/how-relevant-is-logging-out-in-2020
• https://wiki.shibboleth.net/confluence/display/CONCEPT/SLOIssues

[plinss]

@richvdh I accept there are issues with SLO, but it's not useless. Let's please not let that stop SLO from being implemented here.

I'm currently using Matrix/Element with SAML login, I cannot log out of Element and log back in as another account unless I switch to another application that supports SLO and log out there as well.

The situation:

1. I log in to Element via SAML/SSO.
2. I log out of Element.
3. I try to log back in to Element, but as I'm still logged in via SSO, I'm immediately logged back in to the same account, with no option to select another account.

This is a horrible, and confusing, UX. I understand what's going on, and how to correct the situation, but casual users do not. This causes frustration and support calls. I accept it's not a common issue, but it is an issue.

[richvdh]

related: #4158

[jonathanmmm]

@richvdh I accept there are issues with SLO, but it's not useless. Let's please not let that stop SLO from being implemented here.

I'm currently using Matrix/Element with SAML login, I cannot log out of Element and log back in as another account unless I switch to another application that supports SLO and log out there as well.

The situation:

1. I log in to Element via SAML/SSO.
2. I log out of Element.
3. I try to log back in to Element, but as I'm still logged in via SSO, I'm immediately logged back in to the same account, with no option to select another account.

This is a horrible, and confusing, UX. I understand what's going on, and how to correct the situation, but casual users do not. This causes frustration and support calls. I accept it's not a common issue, but it is an issue.

This should really be possible, if you go to a pc that is not yours and press logout, you expect to be logged out. Telling every user and reminding them that they give away their private messages for the next user at this computer is not the way to go.
Using session_timeout of some kind makes the whole point broken for users that are using their own device.

This should at least be put into homeserver.yaml as a security warning or some kind.
If I log out, I want the session to be deleted. I can still be logged into other services, until I log out of them as well.

[plinss]

@jonathanmmm it’s not a matter of the Matrix session data not getting deleted, because it does get deleted when you log out.

The issue is that the log out is not communicated back to the SSO server. So the next time someone loads a Matrix client on that browser, it redirects to the SSO server which still has a valid session, so it silently logs the user back in to Matrix.

The minimum fix is for a Matrix logout to communicate the logout back to the SSO server. The complete fix is to also implement an SSO logout endpoint in Synapse, so when the user logs out of a different app using the same SSO server their Matrix session is ended too (a different, but related issue).

[jonathanmmm]

@jonathanmmm it’s not a matter of the Matrix session data not getting deleted, because it does get deleted when you log out.

The issue is that the log out is not communicated back to the SSO server. So the next time someone loads a Matrix client on that browser, it redirects to the SSO server which still has a valid session, so it silently logs the user back in to Matrix.

The minimum fix is for a Matrix logout to communicate the logout back to the SSO server. The complete fix is to also implement an SSO logout endpoint in Synapse, so when the user logs out of a different app using the same SSO server their Matrix session is ended too (a different, but related issue).

I know, this are different cases. I agree with you, I think. If I log out on a computer that is not mine I expect that I can't be logged into matrix without my password, but right now thats the case. That I have maybe to log out of service x that I have in another tab that also is logged in through OpenID Connect and it doesn't get logged out at the same time, is another story.

[clokep]

#11326 implemented this for OIDC, so #6414 could probably be rebased to re-use much of the existing functionality from that.