authentik.providers.saml.signals

  1"""SAML Provider signals"""
  2
  3from django.db.models.signals import post_save, pre_delete
  4from django.dispatch import receiver
  5from django.http import HttpRequest
  6from django.urls import reverse
  7from structlog.stdlib import get_logger
  8
  9from authentik.core.models import AuthenticatedSession, User
 10from authentik.flows.models import in_memory_stage
 11from authentik.flows.views.executor import FlowExecutorView
 12from authentik.providers.iframe_logout import IframeLogoutStageView
 13from authentik.providers.saml.models import SAMLBindings, SAMLLogoutMethods, SAMLSession
 14from authentik.providers.saml.native_logout import NativeLogoutStageView
 15from authentik.providers.saml.processors.logout_request import LogoutRequestProcessor
 16from authentik.providers.saml.tasks import send_saml_logout_request
 17from authentik.providers.saml.views.flows import (
 18    PLAN_CONTEXT_SAML_LOGOUT_IFRAME_SESSIONS,
 19    PLAN_CONTEXT_SAML_LOGOUT_NATIVE_SESSIONS,
 20    PLAN_CONTEXT_SAML_RELAY_STATE,
 21)
 22from authentik.stages.user_logout.models import UserLogoutStage
 23from authentik.stages.user_logout.stage import flow_pre_user_logout
 24
 25LOGGER = get_logger()
 26
 27
 28@receiver(flow_pre_user_logout)
 29def handle_saml_iframe_pre_user_logout(
 30    sender, request: HttpRequest, user: User, executor: FlowExecutorView, **kwargs
 31):
 32    """Handle SAML iframe logout when user logs out via flow"""
 33
 34    # Only proceed if this is actually a UserLogoutStage
 35    if not isinstance(executor.current_stage, UserLogoutStage):
 36        return
 37
 38    if not user.is_authenticated:
 39        return
 40
 41    auth_session = AuthenticatedSession.from_request(request, user)
 42    if not auth_session:
 43        return
 44
 45    iframe_saml_sessions = (
 46        SAMLSession.objects.filter(
 47            session=auth_session,
 48            user=user,
 49            provider__logout_method=SAMLLogoutMethods.FRONTCHANNEL_IFRAME,
 50        )
 51        .exclude(provider__sls_url="")
 52        .select_related("provider")
 53    )
 54
 55    if not iframe_saml_sessions.exists():
 56        LOGGER.debug("No sessions requiring IFrame frontchannel logout")
 57        return
 58
 59    saml_sessions = []
 60
 61    relay_state = request.build_absolute_uri(
 62        reverse("authentik_core:if-flow", kwargs={"flow_slug": executor.flow.slug})
 63    )
 64
 65    # Store return URL in plan context as fallback if SP doesn't echo relay_state
 66    executor.plan.context[PLAN_CONTEXT_SAML_RELAY_STATE] = relay_state
 67
 68    for session in iframe_saml_sessions:
 69        try:
 70            processor = LogoutRequestProcessor(
 71                provider=session.provider,
 72                user=None,  # User context not needed for logout URL generation
 73                destination=session.provider.sls_url,
 74                name_id=session.name_id,
 75                name_id_format=session.name_id_format,
 76                session_index=session.session_index,
 77                relay_state=relay_state,
 78            )
 79
 80            if session.provider.sls_binding == SAMLBindings.POST:
 81                form_data = processor.get_post_form_data()
 82                logout_data = {
 83                    "url": session.provider.sls_url,
 84                    "saml_request": form_data["SAMLRequest"],
 85                    "provider_name": session.provider.name,
 86                    "binding": SAMLBindings.POST,
 87                }
 88            else:
 89                logout_url = processor.get_redirect_url()
 90                logout_data = {
 91                    "url": logout_url,
 92                    "provider_name": session.provider.name,
 93                    "binding": SAMLBindings.REDIRECT,
 94                }
 95
 96            saml_sessions.append(logout_data)
 97        except (KeyError, AttributeError) as exc:
 98            LOGGER.warning(
 99                "Failed to generate SAML logout URL",
100                provider=session.provider.name,
101                exc=exc,
102            )
103
104    if saml_sessions:
105        executor.plan.context[PLAN_CONTEXT_SAML_LOGOUT_IFRAME_SESSIONS] = saml_sessions
106        # Stage already exists, don't reinject it
107        if not any(
108            binding.stage.view == IframeLogoutStageView for binding in executor.plan.bindings
109        ):
110            iframe_stage = in_memory_stage(IframeLogoutStageView)
111            executor.plan.insert_stage(iframe_stage, index=1)
112
113        LOGGER.debug("saml iframe sessions gathered")
114
115
116@receiver(flow_pre_user_logout)
117def handle_flow_pre_user_logout(
118    sender, request: HttpRequest, user: User, executor: FlowExecutorView, **kwargs
119):
120    """Handle SAML native logout when user logs out via logout flow"""
121
122    # Only proceed if this is actually a UserLogoutStage
123    if not isinstance(executor.current_stage, UserLogoutStage):
124        return
125
126    if not user.is_authenticated:
127        return
128
129    auth_session = AuthenticatedSession.from_request(request, user)
130    if not auth_session:
131        return
132
133    native_saml_sessions = (
134        SAMLSession.objects.filter(
135            session=auth_session,
136            user=user,
137            provider__logout_method=SAMLLogoutMethods.FRONTCHANNEL_NATIVE,
138        )
139        .exclude(provider__sls_url="")
140        .select_related("provider")
141    )
142
143    if not native_saml_sessions.exists():
144        return
145
146    native_sessions = []
147
148    # Generate return URL back to the flow using the interface URL
149    relay_state = request.build_absolute_uri(
150        reverse("authentik_core:if-flow", kwargs={"flow_slug": executor.flow.slug})
151    )
152
153    # Store return URL in plan context as fallback if SP doesn't echo relay_state
154    executor.plan.context[PLAN_CONTEXT_SAML_RELAY_STATE] = relay_state
155
156    for session in native_saml_sessions:
157        try:
158            processor = LogoutRequestProcessor(
159                provider=session.provider,
160                user=None,  # User is already logged out
161                destination=session.provider.sls_url,
162                name_id=session.name_id,
163                name_id_format=session.name_id_format,
164                session_index=session.session_index,
165                relay_state=relay_state,
166            )
167
168            if session.provider.sls_binding == SAMLBindings.POST:
169                form_data = processor.get_post_form_data()
170                logout_data = {
171                    "post_url": session.provider.sls_url,
172                    "saml_request": form_data["SAMLRequest"],
173                    "saml_relay_state": form_data["RelayState"],
174                    "provider_name": session.provider.name,
175                    "saml_binding": SAMLBindings.POST,
176                }
177            else:
178                logout_url = processor.get_redirect_url()
179                logout_data = {
180                    "redirect_url": logout_url,
181                    "provider_name": session.provider.name,
182                    "saml_binding": SAMLBindings.REDIRECT,
183                }
184
185            native_sessions.append(logout_data)
186        except (KeyError, AttributeError) as exc:
187            LOGGER.warning(
188                "Failed to generate SAML native logout data",
189                provider=session.provider.name,
190                exc=exc,
191            )
192
193    if native_sessions:
194        executor.plan.context[PLAN_CONTEXT_SAML_LOGOUT_NATIVE_SESSIONS] = native_sessions
195        native_logout_stage = in_memory_stage(NativeLogoutStageView)
196        executor.plan.insert_stage(native_logout_stage, index=2)
197
198
199@receiver(pre_delete, sender=AuthenticatedSession)
200def user_session_deleted_saml_logout(sender, instance: AuthenticatedSession, **_):
201    """Send SAML backchannel logout requests when user session is deleted"""
202
203    backchannel_saml_sessions = (
204        SAMLSession.objects.filter(
205            session=instance,
206            provider__logout_method=SAMLLogoutMethods.BACKCHANNEL,
207            provider__sls_binding=SAMLBindings.POST,
208        )
209        .exclude(provider__sls_url="")
210        .select_related("provider", "user")
211    )
212
213    for saml_session in backchannel_saml_sessions:
214        LOGGER.info(
215            "Triggering backchannel SAML logout for deleted user session",
216            user=saml_session.user,
217            provider=saml_session.provider.name,
218            session_index=saml_session.session_index,
219        )
220
221        send_saml_logout_request.send(
222            provider_pk=saml_session.provider.pk,
223            sls_url=saml_session.provider.sls_url,
224            name_id=saml_session.name_id,
225            name_id_format=saml_session.name_id_format,
226            session_index=saml_session.session_index,
227        )
228
229
230@receiver(post_save, sender=User)
231def user_deactivated_saml_logout(sender, instance: User, **kwargs):
232    """Send SAML backchannel logout requests when user is deactivated"""
233    if instance.is_active:
234        return
235
236    backchannel_saml_sessions = (
237        SAMLSession.objects.filter(
238            user=instance,
239            provider__logout_method=SAMLLogoutMethods.BACKCHANNEL,
240            provider__sls_binding=SAMLBindings.POST,
241        )
242        .exclude(provider__sls_url="")
243        .select_related("provider")
244    )
245
246    for saml_session in backchannel_saml_sessions:
247        LOGGER.info(
248            "Triggering backchannel SAML logout for deactivated user",
249            user=instance,
250            provider=saml_session.provider.name,
251            session_index=saml_session.session_index,
252        )
253
254        send_saml_logout_request.send(
255            provider_pk=saml_session.provider.pk,
256            sls_url=saml_session.provider.sls_url,
257            name_id=saml_session.name_id,
258            name_id_format=saml_session.name_id_format,
259            session_index=saml_session.session_index,
260        )