GUACAMOLE-1266: SAML Single Logout

[bayars]

Summary

This MR implements SAML Single Logout functionality for the guacamole-auth-sso-saml extension, allowing users to be logged out of both Guacamole and their SAML Identity Provider in a single action.

Associated with this jira ticket.

Changes

Backend

• ConfigurationService.java: Added two new configuration properties:
  • saml-logout-endpoint
• The SAML IdP's logout endpoint URI
  • saml-post-logout-redirect-uri
• Optional URI to redirect to after logout completes (defaults to callback URL)
  • AuthenticationProviderService.java: Implemented getLogoutURI() method that builds the logout URL with RelayState parameter for post-logout redirect

Frontend

• samlModule.js: New AngularJS module (guacSsoSaml) that listens for the guacLogout event and redirects users to the SAML logout endpoint at api/ext/saml/logout

Documentation

Documentation updated in the guacamole-manual project

Build Configuration

• pom.xml: Added JS/CSS minification plugin configuration using Closure compiler to produce saml.min.js
• guac-manifest.json: Registered the minified JavaScript file

Configuration Example - I already tested them

Test Flow:

• Verify logout without saml-logout-endpoint configured only ends Guacamole session
• Verify logout with saml-logout-endpoint redirects to IdP logout page
• Verify RelayState parameter is correctly appended to logout URL
• Verify post-logout redirect returns user to correct URL
• Verify default post-logout redirect uses callback URL when not explicitly configured

To enable SAML Single Logout, administrators can configure the following properties:

Option 1: guacamole.properties

# Required: The SAML IdP logout endpoint
saml-logout-endpoint: https://idp.example.com/logout

# Optional: Where to redirect after logout (defaults to callback URL)
saml-post-logout-redirect-uri: https://guacamole.example.com/

Option 2: Environment Variables (Docker)

env:
  - SAML_LOGOUT_ENDPOINT: https://idp.example.com/logout                                                                     
  - SAML_POST_LOGOUT_REDIRECT_URI: https://guacamole.example.com/