From 814dea0ea5f7ff284224a8eced2ad8c880f16fd6 Mon Sep 17 00:00:00 2001
From: Brad Jones <brad@jones.name>
Date: Sun, 25 Oct 2015 21:16:40 -0600
Subject: [PATCH 1/2] Confirm session on auth module init against SP, e.g., to
 support IdP-initiated Single Log Out

---
 auth/saml/auth.php  | 36 ++++++++++++++++++++++++++++++++++--
 auth/saml/index.php |  3 ++-
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/auth/saml/auth.php b/auth/saml/auth.php
index 1fe0b83..fd26672 100755
--- a/auth/saml/auth.php
+++ b/auth/saml/auth.php
@@ -26,12 +26,44 @@
 **/
 class auth_plugin_saml extends auth_plugin_base {
 
+    /**
+     * The SAML session index from the SP.
+     */
+    protected static $sessionIndex;
+
+    /**
+     * The SP.
+     */
+    protected static $sp;
+
+    /**
+     * Are we currently forcing log-out?
+     */
+    protected static $forcingLogout = FALSE;
+
     /**
     * Constructor.
     */
     function auth_plugin_saml() {
-		$this->authtype = 'saml';
-		$this->config = get_config('auth/saml');
+        $this->authtype = 'saml';
+        $this->config = get_config('auth/saml');
+        // Include the autoloader since Moodle isn't a composer project itself.
+        require_once($this->config->samllib . '/_autoload.php');
+        if (empty(static::$sp)) {
+            static::$sp = new SimpleSAML_Auth_Simple($this->config->sp_source);
+        }
+        // Additionally determine if the user is still logged in to the SP.
+        global $USER;
+        global $SESSION;
+            if ($USER->loggedin && $USER->auth == "saml") {
+                if (!static::$forcingLogout
+                    &&(!static::$sp->isAuthenticated()
+                    || (static::$sp->getAuthData('saml:sp:SessionIndex') != $SESSION->auth_saml['SessionIndex']))) {
+                    // The user is logged in with the saml module but doesn't share a session on the SP.
+                    static::$forcingLogout = TRUE;
+                    require_logout();
+                }
+            }
     }
 
     /**
diff --git a/auth/saml/index.php b/auth/saml/index.php
index 99166c7..bdb05c2 100755
--- a/auth/saml/index.php
+++ b/auth/saml/index.php
@@ -207,7 +207,7 @@
 
         $USER = complete_user_login($user);
 
-        if (function_exists('saml_hook_post_user_created')) {
+        if (function_exists('saml_hook_post_user_created') && !$user_exists && $USER->id) {
             saml_hook_post_user_created($USER);
         }
 
@@ -218,6 +218,7 @@
         $USER->loggedin = true;
         $USER->site = $CFG->wwwroot;
         set_moodle_cookie($USER->username);
+      $SESSION->auth_saml['SessionIndex'] = $as->getAuthData('saml:sp:SessionIndex');
 
         if(isset($err) && !empty($err)) {
             auth_saml_error($err, $urltogo, $pluginconfig->samllogfile);

From 45699e25d88714d35714a265fcf2d8589f4cb904 Mon Sep 17 00:00:00 2001
From: Brad Jones <brad@jones.name>
Date: Tue, 27 Oct 2015 14:02:54 -0600
Subject: [PATCH 2/2] Use NameID instead to confirm session.

---
 auth/saml/auth.php  | 9 ++-------
 auth/saml/index.php | 2 +-
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/auth/saml/auth.php b/auth/saml/auth.php
index fd26672..2769f9b 100755
--- a/auth/saml/auth.php
+++ b/auth/saml/auth.php
@@ -26,11 +26,6 @@
 **/
 class auth_plugin_saml extends auth_plugin_base {
 
-    /**
-     * The SAML session index from the SP.
-     */
-    protected static $sessionIndex;
-
     /**
      * The SP.
      */
@@ -57,8 +52,8 @@ function auth_plugin_saml() {
         global $SESSION;
             if ($USER->loggedin && $USER->auth == "saml") {
                 if (!static::$forcingLogout
-                    &&(!static::$sp->isAuthenticated()
-                    || (static::$sp->getAuthData('saml:sp:SessionIndex') != $SESSION->auth_saml['SessionIndex']))) {
+                    && (!static::$sp->isAuthenticated()
+                    || (static::$sp->getAuthData('saml:sp:NameID') != $SESSION->auth_saml['NameID']))) {
                     // The user is logged in with the saml module but doesn't share a session on the SP.
                     static::$forcingLogout = TRUE;
                     require_logout();
diff --git a/auth/saml/index.php b/auth/saml/index.php
index bdb05c2..fd0b155 100755
--- a/auth/saml/index.php
+++ b/auth/saml/index.php
@@ -218,7 +218,7 @@
         $USER->loggedin = true;
         $USER->site = $CFG->wwwroot;
         set_moodle_cookie($USER->username);
-      $SESSION->auth_saml['SessionIndex'] = $as->getAuthData('saml:sp:SessionIndex');
+        $SESSION->auth_saml['NameID'] = $as->getAuthData('saml:sp:NameID');
 
         if(isset($err) && !empty($err)) {
             auth_saml_error($err, $urltogo, $pluginconfig->samllogfile);