diff --git a/packages/meteor-accounts-saml/saml_client.js b/packages/meteor-accounts-saml/saml_client.js index 22cc21ed7a0a..5a6432e207a5 100644 --- a/packages/meteor-accounts-saml/saml_client.js +++ b/packages/meteor-accounts-saml/saml_client.js @@ -9,19 +9,31 @@ if (!Accounts.saml) { // If we find a samlProvider, and we are using single // logout we will initiate logout from rocketchat via saml. // If not using single logout, we just do the standard logout. +// This can be overridden by a configured logout behaviour. // // TODO: This may need some work as it is not clear if we are really // logging out of the idp when doing the standard logout. const MeteorLogout = Meteor.logout; +const logoutBehaviour = { + TERMINATE_SAML: 'SAML', + ONLY_RC: 'Local' +}; Meteor.logout = function() { - const samlService = ServiceConfiguration.configurations.findOne({service: 'saml'}); + const samlService = ServiceConfiguration.configurations.findOne({ service: 'saml' }); if (samlService) { const provider = samlService.clientConfig && samlService.clientConfig.provider; if (provider) { - if (samlService.idpSLORedirectURL) { - return Meteor.logoutWithSaml({ provider }); + if (samlService.logoutBehaviour == null || samlService.logoutBehaviour === logoutBehaviour.TERMINATE_SAML) { + if (samlService.idpSLORedirectURL) { + console.info('SAML session terminated via SLO'); + return Meteor.logoutWithSaml({ provider }); + } + } + + if (samlService.logoutBehaviour === logoutBehaviour.ONLY_RC) { + console.info('SAML session not terminated, only the Rocket.Chat session is going to be killed'); } } } diff --git a/packages/meteor-accounts-saml/saml_rocketchat.js b/packages/meteor-accounts-saml/saml_rocketchat.js index 31b5aeffa125..3425ca7173bf 100644 --- a/packages/meteor-accounts-saml/saml_rocketchat.js +++ b/packages/meteor-accounts-saml/saml_rocketchat.js @@ -85,6 +85,16 @@ Meteor.methods({ section: name, i18nLabel: 'SAML_Custom_Generate_Username' }); + RocketChat.settings.add(`SAML_Custom_${ name }_logout_behaviour`, 'SAML', { + type: 'select', + values: [ + {key: 'SAML', i18nLabel: 'SAML_Custom_Logout_Behaviour_Terminate_SAML_Session'}, + {key: 'Local', i18nLabel: 'SAML_Custom_Logout_Behaviour_End_Only_RocketChat'} + ], + group: 'SAML', + section: name, + i18nLabel: 'SAML_Custom_Logout_Behaviour' + }); } }); @@ -100,6 +110,7 @@ const getSamlConfigs = function(service) { idpSLORedirectURL: RocketChat.settings.get(`${ service.key }_idp_slo_redirect_url`), generateUsername: RocketChat.settings.get(`${ service.key }_generate_username`), issuer: RocketChat.settings.get(`${ service.key }_issuer`), + logoutBehaviour: RocketChat.settings.get(`${ service.key }_logout_behaviour`), secret: { privateKey: RocketChat.settings.get(`${ service.key }_private_key`), publicCert: RocketChat.settings.get(`${ service.key }_public_cert`), diff --git a/packages/rocketchat-i18n/i18n/de.i18n.json b/packages/rocketchat-i18n/i18n/de.i18n.json index 8468f8015b5d..e55c976a78be 100644 --- a/packages/rocketchat-i18n/i18n/de.i18n.json +++ b/packages/rocketchat-i18n/i18n/de.i18n.json @@ -1545,6 +1545,9 @@ "SAML_Custom_Generate_Username": "Benutzernamen generieren", "SAML_Custom_IDP_SLO_Redirect_URL": "IDP SLO Redirect URL", "SAML_Custom_Issuer": "Benutzerdefinierter Aussteller", + "SAML_Custom_Logout_Behaviour": "Logout-Verhalten", + "SAML_Custom_Logout_Behaviour_Terminate_SAML_Session": "SAML-Session beenden", + "SAML_Custom_Logout_Behaviour_End_Only_RocketChat": "Nur von Rocket.Chat abmelden", "SAML_Custom_Private_Key": "Privater Schlüssel", "SAML_Custom_Provider": "Benutzerdefinierter Provider", "SAML_Custom_Public_Cert": "Öffentliches Zertifikat", diff --git a/packages/rocketchat-i18n/i18n/en.i18n.json b/packages/rocketchat-i18n/i18n/en.i18n.json index 3729ef91ac3d..3e7a6a21d211 100644 --- a/packages/rocketchat-i18n/i18n/en.i18n.json +++ b/packages/rocketchat-i18n/i18n/en.i18n.json @@ -1623,6 +1623,9 @@ "SAML_Custom_Generate_Username": "Generate Username", "SAML_Custom_IDP_SLO_Redirect_URL": "IDP SLO Redirect URL", "SAML_Custom_Issuer": "Custom Issuer", + "SAML_Custom_Logout_Behaviour": "Logout Behaviour", + "SAML_Custom_Logout_Behaviour_Terminate_SAML_Session": "Terminate SAML-session", + "SAML_Custom_Logout_Behaviour_End_Only_RocketChat": "Only log out from Rocket.Chat", "SAML_Custom_Private_Key": "Private Key Contents", "SAML_Custom_Provider": "Custom Provider", "SAML_Custom_Public_Cert": "Public Cert Contents",