providers/saml: send logoutResponse on sp-init logout by PeshekDotDev · Pull Request #17691 · goauthentik/authentik

PeshekDotDev · 2025-10-24T07:38:38Z

Details

This PR automatically sends a logoutResponse when logging out of a samlprovider via the SP

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make docs)

netlify · 2025-10-24T07:38:43Z

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	`ee19e30`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/694087c5b2133f0008e2a043

netlify · 2025-10-24T07:38:44Z

✅ Deploy Preview for authentik-integrations canceled.

Name	Link
🔨 Latest commit	`ee19e30`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/694087c30541fb0008395bb2

netlify · 2025-10-24T07:39:08Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`f4d342a`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/69850ab692a61200087784c4
😎 Deploy Preview	https://deploy-preview-17691--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2025-10-24T07:45:15Z

Codecov Report

❌ Patch coverage is 88.24701% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.20%. Comparing base (49a9cbf) to head (f4d342a).
⚠️ Report is 86 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...iders/saml/processors/logout_response_processor.py	68.00%	32 Missing ⚠️
authentik/providers/saml/views/sp_slo.py	22.85%	27 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #17691      +/-   ##
==========================================
- Coverage   93.23%   93.20%   -0.04%     
==========================================
  Files         968      971       +3     
  Lines       53567    54053     +486     
==========================================
+ Hits        49945    50380     +435     
- Misses       3622     3673      +51

Flag	Coverage Δ
conformance	`37.71% <10.55%> (-0.27%)`	⬇️
e2e	`43.63% <10.95%> (-0.32%)`	⬇️
integration	`22.61% <9.36%> (-0.10%)`	⬇️
unit	`91.39% <87.84%> (-0.01%)`	⬇️
unit-migrate	`91.41% <87.84%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2025-10-24T08:07:37Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-afe9b73f82be2eeb369d5fc100fd61e2c46e1210
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-afe9b73f82be2eeb369d5fc100fd61e2c46e1210

Afterwards, run the upgrade commands from the latest release notes.

BeryJu · 2025-12-15T17:25:58Z

web/src/flow/providers/saml/NativeLogoutStage.ts

+            const messageKey = this.challenge.samlResponse ? "response" : "request";
            return html`<ak-flow-card .challenge=${this.challenge} loading>
                <span slot="title"
-                    >${msg(str`Posting logout request to SAML provider: ${providerName}`)}</span
+                    >${msg(
+                        str`Posting logout ${messageKey} to SAML provider: ${providerName}`,
+                    )}</span


Should be separate strings instead to better support translation (for the messageKey

BeryJu · 2025-12-15T17:32:34Z

web/src/flow/providers/IFrameLogoutStage.ts

 interface LogoutURLData {
    url: string;
    saml_request?: string;
+    saml_response?: string;
+    relay_state?: string;
    provider_name?: string;
    binding?: string;
 }


This shouldn't need to be defined manually, they should come from the API schema

class LogoutURL(PassiveSerializer): url = CharField() [ ... ] class IframeLogoutChallenge(Challenge): """Challenge for iframe logout""" component = CharField(default="ak-provider-iframe-logout") logout_urls = ListField(child=LogoutURL(), default=list)

BeryJu · 2025-12-15T17:32:52Z

web/src/flow/providers/IFrameLogoutStage.ts

enum LogoutStatusStatus { "pending" , "success" , "error", } interface LogoutStatus { providerName: string; status: LogoutStatusStatus; }

mainly for the switch case to complain when it's not exhaustive

BeryJu · 2025-12-15T17:34:56Z

web/src/flow/stages/autosubmit/AutosubmitStage.ts

+    firstUpdated(changed: PropertyValues<this>): void {
+        super.firstUpdated(changed);

        if (this.challenge.url !== undefined) {


Suggested change

if (this.challenge.url !== undefined) {

if (changed.has("challenge") && this.challenge.url !== undefined) {

disclaimer: my solution, not @goauthentik/frontend approved

authentik/providers/iframe_logout.py

BeryJu · 2025-12-30T19:21:29Z

authentik/providers/saml/native_logout.py

Suggested change

component = CharField(default="ak-provider-saml-native-logout")

provider_name = CharField()

url = CharField()

binding = CharField() # If possible, choice field

saml_request = CharField(required=False)

saml_response = CharField(required=False)

relay_state = CharField(required=False)

is_complete = BooleanField(default=False)

Signed-off-by: Connor Peshek <connor@connorpeshek.me>

BeryJu · 2026-02-05T19:06:35Z

authentik/providers/iframe_logout.py

+class SAMLLogoutURL(LogoutURL):
+    """SAML-specific logout URL data"""
+
+    saml_request = CharField(required=False, allow_null=True)
+    saml_response = CharField(required=False, allow_null=True)
+    saml_relay_state = CharField(required=False, allow_null=True)
+


For the time being we can just do a single class actually

* main: (59 commits) website/docs: 2025.12.4 release notes (#20226) website/docs: 2025.10.4 release notes (#20242) security: CVE-2026-25748 (#20240) security: CVE-2026-25922 (#20241) security: CVE-2026-25227 (#20239) ci: fix release testing (#20207) core: Apply CSpell corrections. (#20191) core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770842608 (#20213) core, web: update translations (#20215) core: bump library/node from 25.6.0-trixie to 25.6.1-trixie in /website (#20220) core: bump google-api-python-client from 2.189.0 to 2.190.0 (#20217) core: bump webauthn from 2.7.0 to 2.7.1 (#20218) ci: bump docker/build-push-action from 6.18.0 to 6.19.1 (#20221) website/integrations: Update Komga instructions to add "email_verified" attribute to "email" claim. (#20135) website: Apply CSpell corrections. (#20189) providers/saml: send logoutResponse on sp-init logout (#17691) website/docs: ssf: update SSF documentation (#20195) website/docs: draft of new WS-Fed provider docs (#20091) website/docs: add email verification scope doc (#20141) website/docs: correct reference to overriden S3 variable (#20156) ...

PeshekDotDev changed the title ~~Automatically send logoutResponse via iframe~~ providers/saml: Automatically send logoutResponse via iframe Oct 24, 2025

BeryJu added this to authentik Core Oct 27, 2025

github-project-automation bot moved this to Todo in authentik Core Oct 27, 2025

BeryJu added this to the Release 2025.12 milestone Oct 27, 2025

BeryJu assigned PeshekDotDev Oct 27, 2025

providers/saml: send logoutResponse on sp-init logout

9947850

PeshekDotDev force-pushed the saml-logout-response branch from 50b9b38 to 9947850 Compare November 6, 2025 01:27

PeshekDotDev changed the title ~~providers/saml: Automatically send logoutResponse via iframe~~ providers/saml: send logoutResponse on sp-init logout Nov 6, 2025

connor peshek added 2 commits November 5, 2025 21:08

Use first updated to fix multiple submits

cc6a683

add backchannel logoutResponse

b84edc3

PeshekDotDev marked this pull request as ready for review November 13, 2025 03:10

PeshekDotDev requested review from a team as code owners November 13, 2025 03:10

PeshekDotDev requested review from fheisler and melizeche November 13, 2025 03:10

PeshekDotDev marked this pull request as draft November 13, 2025 03:11

PeshekDotDev marked this pull request as ready for review December 9, 2025 22:07

update tests

836c410

PeshekDotDev force-pushed the saml-logout-response branch from a2403c8 to 836c410 Compare December 10, 2025 09:03

tests

1a140b9

GirlBossRush approved these changes Dec 13, 2025

View reviewed changes

connor peshek added 2 commits December 14, 2025 17:45

Merge branch 'main' into saml-logout-response

be09f7a

remove unused method

2db7b2f

BeryJu reviewed Dec 15, 2025

View reviewed changes

Update front-end

ee19e30

PeshekDotDev added the backport/version-2025.12 Add this label to PRs to backport changes to version-2025.12 label Dec 16, 2025

BeryJu reviewed Dec 30, 2025

View reviewed changes

authentik/providers/iframe_logout.py Show resolved Hide resolved

BeryJu reviewed Dec 30, 2025

View reviewed changes

PeshekDotDev moved this from Todo to In review in authentik Core Jan 6, 2026

rissson removed the backport/version-2025.12 Add this label to PRs to backport changes to version-2025.12 label Jan 14, 2026

rissson modified the milestones: Release 2025.12, Release 2026.2 Jan 14, 2026

PeshekDotDev added 3 commits February 2, 2026 02:17

Merge branch 'main' into saml-logout-response

7cae7fb

Signed-off-by: Connor Peshek <connor@connorpeshek.me>

add feedback

8518d59

lint

4698a30

BeryJu reviewed Feb 5, 2026

View reviewed changes

BeryJu approved these changes Feb 5, 2026

View reviewed changes

github-project-automation bot moved this from In review to In Progress in authentik Core Feb 5, 2026

PeshekDotDev added 2 commits February 5, 2026 15:24

remove samllogouturl

afe9b73

Merge branch 'main' into saml-logout-response

f4d342a

PeshekDotDev moved this from In Progress to In review in authentik Core Feb 6, 2026

PeshekDotDev merged commit 858a040 into main Feb 11, 2026
101 of 102 checks passed

PeshekDotDev deleted the saml-logout-response branch February 11, 2026 20:18

github-project-automation bot moved this from In review to Done in authentik Core Feb 11, 2026

	if (this.challenge.url !== undefined) {
	if (changed.has("challenge") && this.challenge.url !== undefined) {

+component = CharField(default="ak-provider-saml-native-logout")
+provider_name = CharField()
+url = CharField()
+binding = CharField() # If possible, choice field
+saml_request = CharField(required=False)
+saml_response = CharField(required=False)
+relay_state = CharField(required=False)
+is_complete = BooleanField(default=False)

Uh oh!

Conversation

PeshekDotDev commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Checklist

Uh oh!

netlify bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs canceled.

Uh oh!

netlify bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-integrations canceled.

Uh oh!

netlify bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

codecov bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BeryJu Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

BeryJu Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

BeryJu Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

BeryJu Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

BeryJu Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BeryJu Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

BeryJu Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

PeshekDotDev commented Oct 24, 2025 •

edited

Loading

netlify bot commented Oct 24, 2025 •

edited

Loading

netlify bot commented Oct 24, 2025 •

edited

Loading

netlify bot commented Oct 24, 2025 •

edited

Loading

codecov bot commented Oct 24, 2025 •

edited

Loading

github-actions bot commented Oct 24, 2025 •

edited

Loading