{"record":{"id":"efb30efd9d939626","repo":"BookStackApp/BookStack","slug":"errors-saml-already-logged-in","errorCode":null,"errorMessage":"errors.saml_already_logged_in","messagePattern":"errors\\.saml_already_logged_in","errorType":"exception","errorClass":"SamlException","httpStatus":null,"severity":"warning","filePath":"app/Access/Saml2Service.php","lineNumber":365,"sourceCode":"\n        if ($this->shouldSyncGroups()) {\n            $userDetails['groups'] = $this->getUserGroups($samlAttributes);\n        }\n\n        if ($this->config['dump_user_details']) {\n            throw new JsonDebugException([\n                'id_from_idp'         => $samlID,\n                'attrs_from_idp'      => $samlAttributes,\n                'attrs_after_parsing' => $userDetails,\n            ]);\n        }\n\n        if (empty($userDetails['email'])) {\n            throw new SamlException(trans('errors.saml_no_email_address'));\n        }\n\n        if ($isLoggedIn) {\n            throw new SamlException(trans('errors.saml_already_logged_in'), '/login');\n        }\n\n        $user = $this->registrationService->findOrRegister(\n            $userDetails['name'],\n            $userDetails['email'],\n            $userDetails['external_id']\n        );\n\n        if ($this->shouldSyncGroups()) {\n            $this->groupSyncService->syncUserWithFoundGroups($user, $userDetails['groups'], $this->config['remove_from_groups']);\n        }\n\n        $this->loginService->login($user, 'saml2');\n\n        return $user;\n    }\n}\n","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/Saml2Service.php#L347-L383","documentation":"SamlException thrown when the user arriving at the SAML2 ACS callback is already logged into BookStack. processLoginCallback refuses to run the find-or-register flow for an authenticated session, redirecting to /login instead, to avoid hijacking or mixing existing sessions.","triggerScenarios":"A user with an active BookStack session initiates SAML login again (e.g. visits the /saml2/login route or an auto-initiated login while already authenticated) and completes the IdP round-trip; $isLoggedIn is true when processLoginCallback executes.","commonSituations":"User bookmarks the SAML login URL and clicks it while logged in; session remembered via 'remember me' while the IdP session also persists; an automated/auto-initiated IdP login (IdP-initiated SSO) triggered from an already-authenticated tab.","solutions":["Simply log out of BookStack (or the browser session) before retrying SAML login, or navigate to /login and choose the normal route","Guard the SAML login entry point in your app/redirect logic: if the user is already authenticated, skip calling /saml2/login and route them to the dashboard","If this occurs on every login, check for mismatched session cookies (e.g. APP_URL vs actual host, or multiple BookStack instances sharing a cookie domain) that make BookStack think the user is logged in","Clear cookies for the BookStack domain to remove stale authenticated sessions"],"exampleFix":"// before: blindly linking SAML login\n<a href=\"/saml2/login\">Login with SAML</a>\n// after: only initiate SAML for guests\n@auth <a href=\"/\">Dashboard</a> @else <a href=\"/saml2/login\">Login with SAML</a> @endauth","handlingStrategy":"validation","validationCode":"// Only initiate SAML login for guests\nif (auth()->check()) {\n    return redirect('/'); // already logged in; skip /saml2/login\n}","typeGuard":"function canInitiateSamlLogin(\\Illuminate\\Contracts\\Auth\\Guard $auth): bool\n{\n    return !$auth->check();\n}","tryCatchPattern":"use BookStack\\Exceptions\\SamlException;\n\ntry {\n    $saml->processLoginCallback();\n} catch (SamlException $e) {\n    if ($e->getMessage() === trans('errors.saml_already_logged_in')) {\n        return redirect('/'); // or '/login' as the exception suggests\n    }\n    throw $e;\n}","preventionTips":["Hide/disable SAML login entry points for already-authenticated users in your theme/redirect logic","Avoid bookmarking or auto-refreshing the /saml2/login URL","Keep APP_URL and cookie settings consistent so stale authenticated sessions aren't misdetected","Clear BookStack cookies if you switch between environments sharing a cookie domain"],"tags":["saml2","authentication","session"],"backgroundTag":"sso-login-while-authenticated","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}