fix(saml): use connection samlAudienceOverride as Issuer in SLO LogoutRequest

[LeighBriody24]

Fixes #4076

Summary

When Polis builds the SAML LogoutRequest, it uses the global samlAudience as the <saml:Issuer> and ignores the connection's samlAudienceOverride. The login path uses the override (connection.samlAudienceOverride ?? samlAudience), so any connection that sets samlAudienceOverride sends a different Issuer at login and at logout.

Whether that breaks logout depends on the IdP. Strict IdPs (Microsoft Entra / Azure AD in particular) reject it, because the Issuer doesn't match the participant recorded at login, returning AADSTS50068 and leaving the IdP session open (screenshot below). Lenient IdPs accept the mismatch, which is why it isn't always visible.

What does this PR do?

For SLO to work, login and logout have to send the same SP Issuer. The login path already handles this: it uses connection.samlAudienceOverride ?? samlAudience. The logout path doesn't; it always sends opts.samlAudience.

This change makes logout read samlAudienceOverride off the connection when building the LogoutRequest, falling back to the global audience just like login does. Connections without an override are unaffected.

Problem

LogoutController.createRequest built the request like this:

providerName: this.opts.samlAudience!,

When a connection has a samlAudienceOverride, the IdP records that override as the session participant at login. Logout then arrives claiming the global audience instead, so the IdP has no matching participant to sign out (the error above).

Solution

const {
  idpMetadata: { slo, provider },
  samlAudienceOverride,
} = samlConnection;

// ...
providerName: samlAudienceOverride ?? this.opts.samlAudience!,

Same behaviour as the login path. SAMLConnection also gains the optional samlAudienceOverride field.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How should this be tested?

Two cases added to test/sso/logout.test.ts:

• With samlAudienceOverride set, the LogoutRequest <saml:Issuer> is the override value.

• Without it, the Issuer falls back to the global samlAudience (no regression).

• New and existing unit tests pass locally with my changes

• Existing unit tests

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new warnings
• I have added tests that prove my fix is effective
• New and existing unit tests pass locally with my changes

[coderabbitai]

📝 Walkthrough

Walkthrough

The SAML connection supports an optional audience override. Logout request generation uses the override when configured and falls back to the global audience. Tests decode the compressed request and verify both issuer values.

Changes

SAML logout audience selection

Layer / File(s)	Summary
Audience override contract and logout validation npm/src/typings.ts, npm/src/controller/logout.ts, npm/test/sso/logout.test.ts	SAMLConnection accepts samlAudienceOverride. Logout requests use this value when present and use samlAudience otherwise. Tests inflate and decode requests to verify both issuer paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: deepakprabhakara

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the SAML logout fix and the use of the connection-specific audience override.
Description check	✅ Passed	The description explains the problem, solution, testing, issue reference, change type, and relevant checklist items.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepakprabhakara]

Thanks @LeighBriody24, the team will review your PR soon.

[CLAassistant]

All committers have signed the CLA.