Identity Provider using SAML Logout Response for a federated domain

Question

I have setup my SSO using SAML protocol for a custom domain users on my azure portal using domain federation settings using the API https://learn.microsoft.com/en-us/graph/api/domain-post-federationconfiguration?view=graph-rest-1.0&tabs=http. Having provided the required url's and federation settings the SSO works completely fine but when user manually signs out form their microsoft service the identity provider is not getting a callback on the "signOutUri" parameter. Am i missing something here? Thanks in advance for the help.

Answer 1

Hi @Ashish Rai

Thank you for reaching us!

I understand that when user manually signs out form their Microsoft service the identity provider is not getting a callback on the "signOutUri" parameter.

Please check that the logout endpoints are configured correctly and check your application is correctly sending SAML logout requests. The SAML protocol supports both single logout (SLO) and single sign-on (SSO). Ensure that the logout request is being sent to the IdP and that the IdP is configured to handle it properly.
The logout request also needs to be configured according to this guide:
Single Sign-Out SAML Protocol

If the issue is unable find collect a fiddler trace and check for the actual SAML logout request being sent from the application to AAD. As the user hits on the sign-out button a saml_logout request gets generated by the app service and sends that saml_logout request to AAD. Azure AD then signs out the user after verifying the signature of the saml_logout request and then broadcasts logout requests to all the service-providers in that session. After that AAD sends a SAML_logout response to the App-service that initiated the signout saml request.

Reference: https://learn.microsoft.com/en-us/answers/questions/148300/azure-ad-saml-2-no-redirection-to-the-sp-after-log
https://learn.microsoft.com/en-us/answers/questions/1107511/azure-saml-logout-behavior

Please let me know if you have any questions and I can help you further.
Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.