RocketChat/Rocket.Chat · error

SLO redirect not configured

Error message

SLO redirect not configured

What it means

SAML Single Logout (SLO) redirect endpoint, action `sloRedirect` (dispatched at SAML.ts:77). The client's logout flow navigates to `/_saml/sloRedirect/<provider>/?redirect=...` (apps/meteor/client/meteor/login/saml.ts), and the server must redirect to the provider's IdP SLO URL, read from the per-provider setting `<service>_idp_slo_redirect_url` (service.idpSLORedirectURL, settings.ts:31). If that setting is empty, the endpoint responds 500 with body 'SLO redirect not configured'.

Source

Thrown at apps/meteor/server/lib/saml/lib/SAML.ts:415

			};

			try {
				await logOutUser(inResponseTo);
			} finally {
				res.writeHead(302, {
					Location: Meteor.absoluteUrl(),
				});
				res.end();
			}
		});
	}

	private static processSLORedirectAction(req: IIncomingMessage, res: ServerResponse, service: IServiceProviderOptions): void {
		const { idpSLORedirectURL } = service;
		const userRedirect = req.query.redirect as string;

		if (!idpSLORedirectURL) {
			res.writeHead(500);
			res.end('SLO redirect not configured');
			return;
		}

		if (!userRedirect || typeof userRedirect !== 'string') {
			res.writeHead(400);
			res.end('Missing redirect parameter');
			return;
		}

		let configuredURL: URL;
		let requestURL: URL;

		try {
			configuredURL = new URL(idpSLORedirectURL);
			requestURL = new URL(userRedirect);
		} catch {
			res.writeHead(400);

View on GitHub (pinned to 2a7de45707)

Solutions

1. Set the provider's SLO redirect URL: Administration > SAML > <provider> > the field backing `idp_slo_redirect_url`, then retry logout
2. Copy the SingleLogoutService Location from the IdP metadata into that setting
3. If SLO is not meant to be used, avoid the SAML logout flow (use local logout) until the field is configured
4. Remember each custom provider has its own SLO setting - configure the one named in the URL

// Only route users into SAML SLO when the provider has an SLO redirect URL configured
const sloConfigured = Boolean(settings.get(`${service}_idp_slo_redirect_url`));
if (!sloConfigured) {
  doLocalLogout();
} else {
  window.location.replace(`/_saml/sloRedirect/${provider}/?redirect=${encodeURIComponent(target)}`);
}

When it happens

Trigger: Calling `/_saml/sloRedirect/<provider>/` for a provider whose Custom SAML `idp_slo_redirect_url` setting is blank - i.e. SAML was configured for login only and the SLO flow was never set up.

Common situations: SAML provider set up for SSO only; IdP metadata imported but the SingleLogoutService URL never copied into the Rocket.Chat provider settings; provider renamed so the old setting key no longer resolves; admins assuming logout works locally while clients always trigger SAML logout.

Related errors

• SAML Provider not loaded due to invalid configuration
• user-not-found
• registration-disabled-authentication-services
• Invalid connection details
• Missing redirect parameter

AI-assisted analysis of RocketChat/Rocket.Chat@2a7de45707 (2026-08-18). Data as JSON: /api/errors/db9ca229c2957295. Report an issue: GitHub.