Azure SAML Logout Behavior

Question

Azure SAML Logout Behavior

Brad Hill 21

Using Azure Active Directory, we have created several enterprise applications for use with SAML authentication. When a user logs out of any one of those applications, all open (SAML authenticated) applications are automatically logged out as well. Is there a way to control this behavior? I prefer for only the one application to be logged out without disturbing other SAML apps. Then if the user goes back to that one application, they have to login again. Is that possible?

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-11-30T03:37:26.6+00:00

Hi @Brad Hill ,

I am not sure if this is officially supported since the SAML sign-out is done based on the NameID, as specified in the documentation here: https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol

I would think that the regular sign-out would have issues if the NameID isn't passed and I'm unsure if there is a way around that. There was a similar thread on Stack Overflow in which the suggestion was to sign out from the cookie authentication scheme in order to drop the identity cookies: https://stackoverflow.com/questions/66872791/disable-azure-active-directory-single-logout

Certain IDPs also have settings to block the SLO, but if all of the applications are in Azure, I don't think this will work.

I've reached out to the product team though to see if there is a recommended approach for this scenario. In the meantime, could you provide more details about your use case and why you would want the log out to only apply to one application at a time?

Accepted answer

1 additional answer

Your answer

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-11-30T03:37:26.6+00:00

Hi @Brad Hill ,

I am not sure if this is officially supported since the SAML sign-out is done based on the NameID, as specified in the documentation here: https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol

I would think that the regular sign-out would have issues if the NameID isn't passed and I'm unsure if there is a way around that. There was a similar thread on Stack Overflow in which the suggestion was to sign out from the cookie authentication scheme in order to drop the identity cookies: https://stackoverflow.com/questions/66872791/disable-azure-active-directory-single-logout

Certain IDPs also have settings to block the SLO, but if all of the applications are in Azure, I don't think this will work.

I've reached out to the product team though to see if there is a recommended approach for this scenario. In the meantime, could you provide more details about your use case and why you would want the log out to only apply to one application at a time?

Answer 1

Yes, not using the optional logout URL will serve the purpose, since the optional logout URL is used to send users to a place/page once the logout is complete. The session creator (in this case, Azure AD) signals logout by performing a broadcast to all participating applications in the principal's context. If applications decide to do nothing about this broadcast by Azure AD (by not redirecting users elsewhere) they will stay on the same page where they were previously located. So your solution should work.

Otherwise, the solution depends on the application config, since we don’t own the application code or logic. The SAML handlers/libraries are used by RP-STS/RP Apps responsible to generate and respond to logout requests. The logic would need to be set up to ignore those requests.

All applications participating in the session (Principal/NameID) where the app is initiating a logout will receive a logout request back from Azure AD. This is a broadcast to all resource providers participating in that session with the relevant principal. If Azure AD receives a response back to this logout request (from any other applications participating in the session), Azure AD terminates the session with those resource providers.

So everything depends on whether the other applications in the session respond to the logout request sent by Azure AD. If the other applications in the session ignore this logout request, the user will not be logged out from those apps.

Section 3.7 of the SAML 2.0 core specification describes that there can be multiple participants (other applications) in a session besides your application. If one of the other participants sends a LogoutRequest to the Microsoft identity platform (the session authority), it will send a LogoutRequest back to all the session participants except the participant who sent the initial LogoutRequest. If another participant simultaneously initiated sign-out, there would be a race to see which LogoutRequest reaches Microsoft identity platform first. Therefore, an application should always be prepared to handle a LogoutRequest.

You would need to test for any abnormal behavior since there are benefits to the single logout approach.

-

If the information helped you, please Accept the answer. This will help us and other community members as well.

Answer 2

I think the behavior I want can be accomplished by not providing the optional logout URL in the application's SAML configuration. I noticed that apps without the logout URL provided are not being signed out automatically when I log out of other apps. Additionally, for those apps that are left open, I can close the browser tab and come back to them in another tab without having to log back in. Only closing the browser completely logs them out. It seems I have more testing to do, but I think I've found my answer.

Share via

Azure SAML Logout Behavior

1 additional answer

Your answer