diff --git a/lib/devise_saml_authenticatable/default_idp_entity_id_reader.rb b/lib/devise_saml_authenticatable/default_idp_entity_id_reader.rb index 07d4294..9a10e46 100644 --- a/lib/devise_saml_authenticatable/default_idp_entity_id_reader.rb +++ b/lib/devise_saml_authenticatable/default_idp_entity_id_reader.rb @@ -8,11 +8,17 @@ def self.entity_id(params) allowed_clock_drift: Devise.allowed_clock_drift_in_seconds, ).issuer elsif params[:SAMLResponse] - OneLogin::RubySaml::Response.new( - params[:SAMLResponse], - settings: Devise.saml_config, - allowed_clock_drift: Devise.allowed_clock_drift_in_seconds, - ).issuers.first + response = OneLogin::RubySaml::Response.new(params[:SAMLResponse], + settings: Devise.saml_config, + allowed_clock_drift: Devise.allowed_clock_drift_in_seconds, + ) + doc = REXML::Document.new(response.response) + + if REXML::XPath.match(doc,"/p:LogoutResponse",{ "p" => OneLogin::RubySaml::SamlMessage::PROTOCOL}).any? + REXML::XPath.match(doc,"/p:LogoutResponse/a:Issuer",{ "p" => OneLogin::RubySaml::SamlMessage::PROTOCOL, "a" => OneLogin::RubySaml::SamlMessage::ASSERTION }).first.text + else + response.issuers.first + end end end end