SLO request doesn't kill session user

[jgribonvald]

Describe the bug
When a SAML SLO request is sent by the CAS server to nextcloud, the user session isn't killed whereas the request goes well when activating phpCAS logs. We can see the SAML request as intercepted and without problem of configuration as it's not rejected.

To Reproduce
Steps to reproduce the behavior:

1. Connect to nextcloud with CAS
2. Do a logout from CAS and wait the log of the SAML logout request on PHPcas
3. Refresh the nextcloud UI
4. See that the user is still connected

Software (please complete the following information):

• Server-OS: Debian 9
• HTTP-Server Version: Apache 2.4.0
• PHP-Version: PHP 7.0
• phpCAS-Library-Version: phpCAS 1.3.8
• ownCloud/Nextcloud Version 18.0.4
• user_cas-Version: user_cas 1.8.5

[jgribonvald]

We've found from where the problem is coming: https://github.com/felixrupp/user_cas/blob/master/lib/Service/AppService.php#L903

The NameID with CAS is not provided (or as @NOT_USED@), did you test with a "standard" CAS ? You should use the samlp:SessionIndex to have a mapping with the ST provided at the session init and the session end.

[felixrupp]

Hi @jgribonvald
I see the problem, the point is: without saving and mapping the CAS SessionIndex to the ownCloud/Nextcloud session in the ownCloud/Nextcloud database, there is no other way to match a CAS-session to an ownCloud/Nextcloud session than the user-/login-name.

@pingou2712’s Pull-request solves this issue, but has major changes in source code, which I can not test at the moment. This is why I hesitate to accept the pull-request. You are still free to use the changes of @pingou2712 and test, if it works for yourself.

I’m still open for approaches and/or ideas.

Best regards,
Felix