Fix logout fatal error in simplesamlphp_auth: replace invalid setAccount() call on User entity

Created on 29 April 2025, 15 days ago

Problem/Motivation

When a SAML-authenticated user (via SimpleSAMLphp Auth) uses the Masquerade module and logs out, the site throws a PHP fatal error:

Error: Call to undefined method Drupal\user\Entity\User::setAccount() in simplesamlphp_auth_user_logout()

This happens because the module incorrectly tries to call `$account->setAccount(new AnonymousUserSession());` where `$account` is a User entity, which does not have a `setAccount()` method.

This causes a full site crash when masquerading users under SAML authentication.

---

Steps to reproduce

1. Login as a user authenticated via SimpleSAMLphp (using simplesamlphp_auth).
2. Masquerade as another user (using Masquerade module).
3. Logout.
4. Observe the fatal error: Call to undefined method `User::setAccount()`.

---

Proposed resolution

Replace the invalid method call in `simplesamlphp_auth_user_logout()`.

From:
```php
$account->setAccount(new AnonymousUserSession());

To:
\Drupal::currentUser()->setAccount(new AnonymousUserSession());

Or, optionally use the more standard service:

\Drupal::service('account_switcher')->switchTo(new AnonymousUserSession());

This properly resets the session user without directly manipulating User entities.

Remaining tasks

β€’ Apply the code fix replacing setAccount() call.
β€’ Optionally submit a patch for the fix.
β€’ Review if further logout flows (e.g., SLO integration) should use account_switcher for consistency.

User interface changes

None.

API changes

None.

Data model changes

None.

πŸ› Bug report
Status

Active

Version

4.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States kc2bj

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024