Don't fail if signature provided in query string, but not in the message

grafana · Feb 3, 2023 · 8197ae7 · 8197ae7
1 parent b75d97a
commit 8197ae7
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/service_provider.go b/service_provider.go
@@ -1531,11 +1531,13 @@ func (sp *ServiceProvider) ValidateLogoutResponseRedirect(query url.Values) erro
 		return err
 	}
 
+	hasValidSignature := false
 	if query.Get("Signature") != "" && query.Get("SigAlg") != "" {
 		if err := sp.validateQuerySig(query); err != nil {
 			retErr.PrivateErr = err
 			return retErr
 		}
+		hasValidSignature = true
 	}
 
 	doc := etree.NewDocument()
@@ -1545,8 +1547,10 @@ func (sp *ServiceProvider) ValidateLogoutResponseRedirect(query url.Values) erro
 	}
 
 	if err := sp.validateSignature(doc.Root()); err != nil {
-		retErr.PrivateErr = err
-		return retErr
+		if err != errSignatureElementNotPresent && !hasValidSignature {
+			retErr.PrivateErr = err
+			return retErr
+		}
 	}
 
 	var resp LogoutResponse