CognitoProvider [logout]: Rancher provider resource `%v` con

Error message

CognitoProvider [logout]: Rancher provider resource `%v` configured for forced SLO, rejecting regular logout

What it means

A deliberate policy rejection, not a malfunction: CognitoProvider.Logout found oidcConfig.LogoutAllForced = true on the provider's authConfig, which means an administrator mandates single-logout (SLO) for all sessions. The regular logout endpoint therefore refuses to proceed and directs the caller to the logout-all flow. The provider name in the message identifies the authConfig resource that forced this.

Source

Thrown at pkg/auth/providers/cognito/cognito.go:71

	return Name
}

func (p *CognitoProvider) RefetchGroupPrincipals(principalID string, secret string) ([]v3.Principal, error) {
	return p.OpenIDCProvider.RefetchGroupPrincipals(principalID, secret)
}

func (p *CognitoProvider) UsesUserSecrets() bool      { return true }
func (p *CognitoProvider) CanRefreshPrincipals() bool { return true }

func (p *CognitoProvider) Logout(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {
	providerName := token.GetAuthProvider()
	logrus.Debugf("CognitoProvider [logout]: triggered by provider %s", providerName)
	oidcConfig, err := p.GetConfig()
	if err != nil {
		return fmt.Errorf("getting config for OIDC Logout: %w", err)
	}
	if oidcConfig.LogoutAllForced {
		return fmt.Errorf("CognitoProvider [logout]: Rancher provider resource `%v` configured for forced SLO, rejecting regular logout", providerName)
	}

	return nil
}

func (p *CognitoProvider) LogoutAll(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {
	logrus.Debugf("CognitoProvider [logout-all]: triggered by provider %s", token.GetAuthProvider())
	oidcConfig, err := p.GetConfig()
	if err != nil {
		return err
	}

	providerName := token.GetAuthProvider()
	if !oidcConfig.LogoutAllEnabled {
		return fmt.Errorf("CognitoProvider [logout-all]: Rancher provider resource `%v` not configured for SLO", providerName)
	}

	idpRedirectURL, err := createIDPRedirectURL(r, oidcConfig)

View on GitHub (pinned to 932558d4e6)

Solutions

Call the logout-all endpoint/action instead — it performs the forced SLO the policy demands
If per-session logout must stay available, clear logoutAllForced on the authConfig (admin decision)
Update clients and scripts that assume the plain logout endpoint always succeeds

Defensive patterns

Strategy: validation

Validate before calling

// Route the logout request based on the policy flags before invoking either endpoint
oidcConfig, err := p.GetConfig()
if err != nil { return err }
if oidcConfig.LogoutAllForced {
    return callLogoutAll() // plain logout() is guaranteed to be rejected
}
return p.Logout(w, r, token)

Try / catch

if err := p.Logout(w, r, token); err != nil {
    if strings.Contains(err.Error(), "forced SLO") {
        // policy rejection: switch the client to the logout-all flow, don't retry
        return callLogoutAll()
    }
    return err
}

Prevention

Advertise which logout flows are enabled when forced SLO is turned on, and update clients/scripts accordingly
Treat 'rejecting regular logout' as a routing signal, never as a transient error
Keep the two policy flags (logoutAllEnabled, logoutAllForced) documented in operator runbooks

When it happens

Trigger: Any client invoking the normal logout action while the Rancher authConfig for the provider has logoutAllForced set to true; typical when scripts, old UI code, or bookmarks still target the plain logout endpoint after the admin enabled forced SLO.

Common situations: Admin enabled forced SLO to guarantee IdP session termination; automated tooling or cached UI calling the wrong endpoint; flag enabled globally and operators forgetting the logout flow changed.

Related errors

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/301744c9231efd56. Report an issue: GitHub.