{"record":{"id":"301744c9231efd56","repo":"rancher/rancher","slug":"cognitoprovider-logout-rancher-provider-resourc","errorCode":null,"errorMessage":"CognitoProvider [logout]: Rancher provider resource `%v` configured for forced SLO, rejecting regular logout","messagePattern":"CognitoProvider \\[logout\\]: Rancher provider resource `(.+?)` configured for forced SLO, rejecting regular logout","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/auth/providers/cognito/cognito.go","lineNumber":71,"sourceCode":"\treturn Name\n}\n\nfunc (p *CognitoProvider) RefetchGroupPrincipals(principalID string, secret string) ([]v3.Principal, error) {\n\treturn p.OpenIDCProvider.RefetchGroupPrincipals(principalID, secret)\n}\n\nfunc (p *CognitoProvider) UsesUserSecrets() bool      { return true }\nfunc (p *CognitoProvider) CanRefreshPrincipals() bool { return true }\n\nfunc (p *CognitoProvider) Logout(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {\n\tproviderName := token.GetAuthProvider()\n\tlogrus.Debugf(\"CognitoProvider [logout]: triggered by provider %s\", providerName)\n\toidcConfig, err := p.GetConfig()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting config for OIDC Logout: %w\", err)\n\t}\n\tif oidcConfig.LogoutAllForced {\n\t\treturn fmt.Errorf(\"CognitoProvider [logout]: Rancher provider resource `%v` configured for forced SLO, rejecting regular logout\", providerName)\n\t}\n\n\treturn nil\n}\n\nfunc (p *CognitoProvider) LogoutAll(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {\n\tlogrus.Debugf(\"CognitoProvider [logout-all]: triggered by provider %s\", token.GetAuthProvider())\n\toidcConfig, err := p.GetConfig()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tproviderName := token.GetAuthProvider()\n\tif !oidcConfig.LogoutAllEnabled {\n\t\treturn fmt.Errorf(\"CognitoProvider [logout-all]: Rancher provider resource `%v` not configured for SLO\", providerName)\n\t}\n\n\tidpRedirectURL, err := createIDPRedirectURL(r, oidcConfig)","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/cognito/cognito.go#L53-L89","documentation":"A deliberate policy rejection, not a malfunction: CognitoProvider.Logout found oidcConfig.LogoutAllForced = true on the provider's authConfig, which means an administrator mandates single-logout (SLO) for all sessions. The regular logout endpoint therefore refuses to proceed and directs the caller to the logout-all flow. The provider name in the message identifies the authConfig resource that forced this.","triggerScenarios":"Any client invoking the normal logout action while the Rancher authConfig for the provider has logoutAllForced set to true; typical when scripts, old UI code, or bookmarks still target the plain logout endpoint after the admin enabled forced SLO.","commonSituations":"Admin enabled forced SLO to guarantee IdP session termination; automated tooling or cached UI calling the wrong endpoint; flag enabled globally and operators forgetting the logout flow changed.","solutions":["Call the logout-all endpoint/action instead — it performs the forced SLO the policy demands","If per-session logout must stay available, clear logoutAllForced on the authConfig (admin decision)","Update clients and scripts that assume the plain logout endpoint always succeeds"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Route the logout request based on the policy flags before invoking either endpoint\noidcConfig, err := p.GetConfig()\nif err != nil { return err }\nif oidcConfig.LogoutAllForced {\n    return callLogoutAll() // plain logout() is guaranteed to be rejected\n}\nreturn p.Logout(w, r, token)","typeGuard":null,"tryCatchPattern":"if err := p.Logout(w, r, token); err != nil {\n    if strings.Contains(err.Error(), \"forced SLO\") {\n        // policy rejection: switch the client to the logout-all flow, don't retry\n        return callLogoutAll()\n    }\n    return err\n}","preventionTips":["Advertise which logout flows are enabled when forced SLO is turned on, and update clients/scripts accordingly","Treat 'rejecting regular logout' as a routing signal, never as a transient error","Keep the two policy flags (logoutAllEnabled, logoutAllForced) documented in operator runbooks"],"tags":["cognito","rancher","logout","slo","policy","go"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}