BookStackApp/BookStack · error · Error

Invalid SLS Response:

Error message

Invalid SLS Response: 

What it means

Thrown by Saml2Service::processSlsResponse when the OneLogin toolkit's processSLO() (Single Logout) records errors via getErrors() after processing the logout response/request from the IdP. It signals the SLO message failed validation — commonly a bad signature on the redirect-encoded logout message or a malformed SLO payload. The exception is raised before BookStack performs its local logout via loginService->logout().

Source

Thrown at app/Access/Saml2Service.php:141

     * Process a response for the single logout service.
     *
     * @throws Error
     */
    public function processSlsResponse(?string $requestId): string
    {
        $toolkit = $this->getToolkit();

        // The $retrieveParametersFromServer in the call below will mean the library will take the query
        // parameters, used for the response signing, from the raw $_SERVER['QUERY_STRING']
        // value so that the exact encoding format is matched when checking the signature.
        // This is primarily due to ADFS encoding query params with lowercase percent encoding while
        // PHP (And most other sensible providers) standardise on uppercase.
        /** @var ?string $samlRedirect */
        $samlRedirect = $toolkit->processSLO(true, $requestId, true, null, true);
        $errors = $toolkit->getErrors();

        if (!empty($errors)) {
            throw new Error(
                'Invalid SLS Response: ' . implode(', ', $errors)
            );
        }

        $defaultBookStackRedirect = $this->loginService->logout();

        return $samlRedirect ?? $defaultBookStackRedirect;
    }

    /**
     * Get the metadata for this service provider.
     *
     * @throws Error
     */
    public function metadata(): string
    {
        $toolKit = $this->getToolkit(true);
        $settings = $toolKit->getSettings();

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Verify the IdP x509 certificate configured in BookStack matches the cert used to sign the logout message (re-import current IdP metadata).
2. Check for proxies/rewrite rules altering the query string encoding before it reaches the SLS endpoint; bypass or normalize so the raw QUERY_STRING signature checks out.
3. Confirm the SLS endpoint URL registered at the IdP matches BookStack's saml2 SLS route exactly.
4. Inspect the toolkit error strings in the message and enable SAML debug logging for the exact validation failure; compare with IdP SLO logs.
5. If SLO keeps failing in your environment, accept that local sessions may need manual cleanup: users can be logged out server-side by admin, and you can disable IdP-initiated SLO if the IdP supports it.

Example fix

// before (nginx normalizing query string)
proxy_pass http://app;

// after (preserve raw request URI/args for SLS signature check)
proxy_pass http://app;
proxy_set_header Request_URI $request_uri;

// Preconditions before hitting the SLS endpoint:
// 1. IdP signing cert in SP settings is current
// 2. No proxy/rewrite layer mutates the raw query string (compare $_SERVER['QUERY_STRING'] with what the IdP sent)
// 3. SLS URL registered at the IdP matches the saml2 SLS route exactly

use OneLogin\Saml2\Error as Saml2Error;

try {
    $redirect = $saml2Service->processSlsResponse($requestId);
} catch (Saml2Error $e) {
    report($e);
    // Fail safe: still terminate the local session even if IdP SLO validation failed
    auth()->logout();
    return redirect('/');
}

When it happens

Trigger: The IdP redirects back to the SLS endpoint with query params (SAMLResponse/SAMLRequest + Signature); processSLO(true, $requestId, true, null, true) reads params from the raw $_SERVER['QUERY_STRING'] to verify the signature. Errors arise when the SLS response signature doesn't validate (wrong/rotated IdP cert, proxy or web server re-encoding the query string, e.g. lowercase percent-encoding like ADFS), the relaystate/request-id is mismatched, or the SLO message is malformed.

Common situations: ADFS behind IIS/URL-rewrite lowercasing percent-encoded query strings so signature checks fail (the code comments on exactly this); IdP certificate updated but SP still has the old one; reverse proxy normalizing query params; IdP-initiated logout with an unexpected session index; clock skew invalidating SLO timestamps.

Related errors

• Invalid ACS Response; Errors: {implode(', ', $errors)}; Reas
• Invalid SP metadata:
• Token signature could not be validated using the provided ke
• Unexpected type of key value provided
• Failed to load key from file path with error: {$exception->g

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/264dd441f588e205. Report an issue: GitHub.