PhpMyAdmin SSO Logout - php

Question

I am using PhpMyAdmin and a custom single-sign on (SSO) script for direct login into the interface. The SSO script is called by PHP, given a unique login token by my own system. This script looks up the unique id in my system in order to retrieve MySQL username and password and returns this back to PhpMyAdmin.
This is working so far, but my next goal is automatic logout after a certain amount of inactivity. Without SSO, deleting my browser cookies and clicking any link, I get to the login page with the message »Your session has expired. Please log in again.«. However, I'm not able to reproduce this behavior from within my SSO script.
This is my SSO script:
<?php
/**
* Session timeout in seconds.
*/
define('SESSION_TIMEOUT', 60);
/**
* #return array|null Returns an array with login credentials or null for no login.
*/
function get_login_credentials() {
parse_str($_SERVER['QUERY_STRING'], $query);
/* check for session activity (timeout) */
if (isset($_SESSION['ssoLastActivity']) && (time() - $_SESSION['ssoLastActivity']) > SESSION_TIMEOUT) {
$sessionExpired = true;
} else {
$sessionExpired = false;
}
if (isset($query['old_usr'])) {
/* logout and back to index page */
unset($_SESSION['ssoLastActivity']);
unset($_SESSION['ssoUser']);
unset($_SESSION['ssoPassword']);
header('Location: index.php');
exit;
}
if ($sessionExpired) {
unset($_SESSION['ssoLastActivity']);
unset($_SESSION['ssoUser']);
unset($_SESSION['ssoPassword']);
/******** POINT OF QUESTION ********/
/* I'm trying to give the same response as if the cookies were deleted.
I land on the login page as desired, however I'm missing the session
timeout message. */
header('Content-Type: application/json');
echo json_encode(['redirect_flag' => '1', 'success' => false, 'error' => '']);
exit;
/***********************************/
}
/* update session activity timestamp */
$_SESSION['ssoLastActivity'] = time();
if (!empty($_SESSION['ssoUser']) && !empty($_SESSION['ssoPassword'])) {
/* already logged in */
return [
$_SESSION['ssoUser'],
$_SESSION['ssoPassword'],
];
}
/* retrieve MySQL login credentials here and store them in $user and $password */
/* $user = ...; $password = ...; */
return [
$user,
$password,
];
}
Has anybody a solution for logout via my SSO script, that leads me to the login page with the message, that the session is expired?
UPDATE:
The issue seems to be connected to my PhpMyAdmin server configuration (/etc/phpMyAdmin/servers.ini.php in my case):
<?php
$cfg['Servers'] = array(
1 => array('auth_type' => 'signon', ..., 'SignonScript' => '/usr/share/phpMyAdmin/sso.php', 'SignonURL' => 'index.php?server=1'),
2 => array('auth_type' => 'cookie', ...)
);
I inspected the network request after my session timeout, and it turns out, that there's actually a request with ?session_expired=1 (which triggers the session timeout message) sent to server 1; because this script is returning null (no login), it redirects to the SignonURL index.php?server=1, omitting the extra session_expired query param.
I could extend this url by &session_expired=1, however this would also trigger the message on regular logout.
I'm open for any ideas to improve the behavior.