Users get redirected to a seemingly random URL on session expiry

Commenting here to indicate that #12 is compatible with 4.0.0 running on Drupal 10.1.

I don't think this is the right approach here. Currently the redirect to the base_url isn't happening in the logout hook, it's happening in the event subscriber that checks for session expiry.

  /**
   * Logs out user if not SAML authenticated and local logins are disabled.
   *
   * @param \Symfony\Component\HttpKernel\Event\RequestEvent $event
   *   The subscribed event.
   */
  public function checkAuthStatus(RequestEvent $event) {
    if ($this->account->isAnonymous()) {
      return;
    }

    if (!$this->simplesaml->isActivated()) {
      return;
    }

    if ($this->simplesaml->isAuthenticated()) {
      return;
    }

    if ($this->config->get('allow.default_login')) {

      $allowed_uids = explode(',', $this->config->get('allow.default_login_users'));
      if (in_array($this->account->id(), $allowed_uids)) {
        return;
      }

      $allowed_roles = $this->config->get('allow.default_login_roles');
      if (array_intersect($this->account->getRoles(), $allowed_roles)) {
        return;
      }
    }

    if ($this->config->get('debug')) {
      $this->logger->debug('User %name not authorized to log in using local account.', ['%name' => $this->account->getAccountName()]);
    }
    user_logout();

    $response = new RedirectResponse('/', RedirectResponse::HTTP_FOUND);
    $event->setResponse($response);
    $event->stopPropagation();

  }

Since the logout hook no longer redirects when isAuthenticated() returns false, we are falling back to the redirect response to the event here, redirecting back to the homepage. It seems like we should leave the logout hook alone, and handle redirecting on session expiry here in the event. I can also see a need for this to be configurable, or at the very least a bit smarter. If feels like in most cases the user should be redirected to the login page, and then returned to the current url after logging in, though I could see use cases where a site might want to just let them view the page as anonymous without being redirected. I have a need to solve this this week, so I'll open a MR with my solution soon.

The current MR !28 will redirect any request to a HTML login page but this will cause problems for requests that accept MIME types other than HTML (e.g. JSON:API / GraphQL / image styles / aggregated CSS files / streamed media / ...)

I think it would be safer to simply reload the page so it is served to the anonymous user. While redirecting a logged out user to the login form is valid in many use cases, it is better to leave this to specialized modules that are better suited to this task (like Redirect 403 to User Login).