{"record":{"id":"db9ca229c2957295","repo":"RocketChat/Rocket.Chat","slug":"slo-redirect-not-configured","errorCode":null,"errorMessage":"SLO redirect not configured","messagePattern":"SLO redirect not configured","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"apps/meteor/server/lib/saml/lib/SAML.ts","lineNumber":415,"sourceCode":"\t\t\t};\n\n\t\t\ttry {\n\t\t\t\tawait logOutUser(inResponseTo);\n\t\t\t} finally {\n\t\t\t\tres.writeHead(302, {\n\t\t\t\t\tLocation: Meteor.absoluteUrl(),\n\t\t\t\t});\n\t\t\t\tres.end();\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate static processSLORedirectAction(req: IIncomingMessage, res: ServerResponse, service: IServiceProviderOptions): void {\n\t\tconst { idpSLORedirectURL } = service;\n\t\tconst userRedirect = req.query.redirect as string;\n\n\t\tif (!idpSLORedirectURL) {\n\t\t\tres.writeHead(500);\n\t\t\tres.end('SLO redirect not configured');\n\t\t\treturn;\n\t\t}\n\n\t\tif (!userRedirect || typeof userRedirect !== 'string') {\n\t\t\tres.writeHead(400);\n\t\t\tres.end('Missing redirect parameter');\n\t\t\treturn;\n\t\t}\n\n\t\tlet configuredURL: URL;\n\t\tlet requestURL: URL;\n\n\t\ttry {\n\t\t\tconfiguredURL = new URL(idpSLORedirectURL);\n\t\t\trequestURL = new URL(userRedirect);\n\t\t} catch {\n\t\t\tres.writeHead(400);","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/2a7de457074cbb4d4373fbd9a4e5bea292c9c764/apps/meteor/server/lib/saml/lib/SAML.ts#L397-L433","documentation":"SAML Single Logout (SLO) redirect endpoint, action `sloRedirect` (dispatched at SAML.ts:77). The client's logout flow navigates to `/_saml/sloRedirect/<provider>/?redirect=...` (apps/meteor/client/meteor/login/saml.ts), and the server must redirect to the provider's IdP SLO URL, read from the per-provider setting `<service>_idp_slo_redirect_url` (service.idpSLORedirectURL, settings.ts:31). If that setting is empty, the endpoint responds 500 with body 'SLO redirect not configured'.","triggerScenarios":"Calling `/_saml/sloRedirect/<provider>/` for a provider whose Custom SAML `idp_slo_redirect_url` setting is blank - i.e. SAML was configured for login only and the SLO flow was never set up.","commonSituations":"SAML provider set up for SSO only; IdP metadata imported but the SingleLogoutService URL never copied into the Rocket.Chat provider settings; provider renamed so the old setting key no longer resolves; admins assuming logout works locally while clients always trigger SAML logout.","solutions":["Set the provider's SLO redirect URL: Administration > SAML > <provider> > the field backing `idp_slo_redirect_url`, then retry logout","Copy the SingleLogoutService Location from the IdP metadata into that setting","If SLO is not meant to be used, avoid the SAML logout flow (use local logout) until the field is configured","Remember each custom provider has its own SLO setting - configure the one named in the URL"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Only route users into SAML SLO when the provider has an SLO redirect URL configured\nconst sloConfigured = Boolean(settings.get(`${service}_idp_slo_redirect_url`));\nif (!sloConfigured) {\n  doLocalLogout();\n} else {\n  window.location.replace(`/_saml/sloRedirect/${provider}/?redirect=${encodeURIComponent(target)}`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Warn at settings-save time when a provider enables SAML logout without an SLO redirect URL","Test the full logout flow after every SAML configuration change","Keep IdP metadata (SingleLogoutService URL) and the Rocket.Chat setting in sync"],"tags":["saml","sso","logout","configuration","http-500"],"backgroundTag":"saml-slo-not-configured","analyzedSha":"2a7de457074cbb4d4373fbd9a4e5bea292c9c764","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}