feat(saml2): support manual IdP Single Logout via "slo" config key (#1452)

Author: mbardelmeijer

src/Saml2/Provider.php

@@ -149,6 +149,7 @@ public static function additionalConfigKeys(): array
             'metadata',
             'ttl',
             'acs',
+            'slo',
             'entityid',
             'certificate',
             'sp_acs',
@@ -270,6 +271,7 @@ protected function sendMessage(SamlMessage $message, string $bindingType): HttpF
     protected function getIdentityProviderEntityDescriptorManually(): EntityDescriptor
     {
         $acs = $this->getConfig('acs');
+        $slo = $this->getConfig('slo');
         $entityId = $this->getConfig('entityid');
         $certificate = $this->getConfig('certificate');
 
@@ -281,7 +283,20 @@ protected function getIdentityProviderEntityDescriptorManually(): EntityDescript
 
         $builder = new SimpleEntityDescriptorBuilder($entityId, $acs, $acs, $x509);
 
-        return $builder->get();
+        $entityDescriptor = $builder->get();
+
+        // SimpleEntityDescriptorBuilder only emits a SingleSignOnService, so when an IdP Single Logout location is
+        // configured manually (via "slo"), advertise it here. Without this, logoutResponse() cannot resolve the IdP
+        // logout endpoint unless the IdP is configured through metadata instead.
+        if ($slo) {
+            $idpSsoDescriptor = $entityDescriptor->getFirstIdpSsoDescriptor();
+
+            foreach ([SamlConstants::BINDING_SAML2_HTTP_REDIRECT, SamlConstants::BINDING_SAML2_HTTP_POST] as $binding) {
+                $idpSsoDescriptor->addSingleLogoutService(new SingleLogoutService($slo, $binding));
+            }
+        }
+
+        return $entityDescriptor;
     }
 
     protected function getIdpEntityDescriptorFromXml(string $xml): EntityDescriptor

src/Saml2/README.md

@@ -182,6 +182,17 @@ To publish the SingleLogoutService in your service provider metadata, you also h
 ],
 ```
 
+When the Identity Provider is configured through `metadata`, its SingleLogoutService location is read from that metadata automatically. When configuring the Identity Provider manually (using `acs`), there is no metadata to read it from, so provide the IdP's Single Logout URL with the `slo` key:
+```php
+'saml2' => [
+  'acs' => 'https://idp.co/auth/sso', // the IDP's Single Sign-On URL
+  'slo' => 'https://idp.co/auth/slo', // the IDP's Single Logout URL
+  'entityid' => 'http://saml.to/trust',
+  'certificate' => 'MIIC4jCCAcqgAwIBAgIQbDO5YO....',
+],
+```
+Without `slo`, `logoutResponse()` cannot resolve the IdP logout endpoint for a manually configured Identity Provider.
+
 ### Signing and encryption
 
 SAML2 supports the signing and encryption of messages and assertions. Many Identity Providers make one or both mandatory. To enable this feature, you can generate a certificate for your application and provide it in `config/services.php` as: