From d6888e44b94b0414ad2105e97e994dc55af1bf55 Mon Sep 17 00:00:00 2001
From: Glenn Rice <grice1@missouriwestern.edu>
Date: Thu, 6 Aug 2026 17:32:00 -0500
Subject: [PATCH] Add a configuration option to provide a custom logout URL for
 SAML2 authentication.

If a SAML2 identity provider does not provide a logout URL in its
metadata, and yet one is available for the identity provider, then the
`$saml2{sp}{logout_url}` option can be set to that logout URL, and it
will be used instead of the logout URL from the metadata.

This was requested in issue #3102.
---
 conf/authen_saml2.conf.dist | 7 +++++++
 lib/WeBWorK/Authen/Saml2.pm | 6 ++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/conf/authen_saml2.conf.dist b/conf/authen_saml2.conf.dist
index 7e15974c67..d11495f0d3 100644
--- a/conf/authen_saml2.conf.dist
+++ b/conf/authen_saml2.conf.dist
@@ -134,4 +134,11 @@ $saml2{sp}{private_key_file} = 'docker-config/idp/certs/saml.pem';
 # session for the user with the identity provider.
 $saml2{sp}{enable_sp_initiated_logout} = 0;
 
+# The URL of the identity provider's single logout service is normally read from
+# the SingleLogoutService location in the identity provider's metadata.  If the
+# identity provider's metadata does not advertise a SingleLogoutService, then
+# this can be set to a custom logout URL to use instead. This is only used if
+# $saml2{sp}{enable_sp_initiated_logout} is set to 1.
+#$saml2{sp}{logout_url} = 'https://idp.example.edu/saml2/logout';
+
 1;
diff --git a/lib/WeBWorK/Authen/Saml2.pm b/lib/WeBWorK/Authen/Saml2.pm
index 6c77f65a0e..e92d6c3832 100644
--- a/lib/WeBWorK/Authen/Saml2.pm
+++ b/lib/WeBWorK/Authen/Saml2.pm
@@ -277,8 +277,10 @@ sub logout_user ($self) {
 		return unless $idp;
 
 		my $logoutReq = $self->sp->logout_request(
-			$idp->slo_url(BINDING_HTTP_REDIRECT), $self->session->{saml2_nameid},
-			$idp->format || undef,                $self->session->{saml2_session}
+			$ce->{saml2}{sp}{logout_url} || $idp->slo_url(BINDING_HTTP_REDIRECT),
+			$self->session->{saml2_nameid},
+			$idp->format || undef,
+			$self->session->{saml2_session}
 		);
 
 		debug('Redirecting user to the identity provider for logout');