SP initiated SAML SLO Logout URL configuration

Question

SP initiated SAML SLO Logout URL configuration

photon 6

I am seeing an issue with my SAML configuration with SLO. I have a SP initiated logout work flow for which I have configured "LogoutURL" as below

I have two questions:

Question 1 --> I understand from this document that azure sends Logout request to all SP in the session and after which the Logout response to logout URL. Does Azure send LogoutRequest to the SP initiating the logout? If not, I am not seeing the logout response.

My logout request looks as below.

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0" ID="_7c12b29b-f538-4956-a407-9db035f07733" IssueInstant="2022-12-31T04:56:34.507Z" NotOnOrAfter="2022-12-31T04:58:04.507Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
matching-entityId
</saml2:Issuer>
<saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
test@keyman .com
</saml2:NameID>
<saml2p:SessionIndex>
_dc156a51-cef2-4cf4-872b-600892254801
</saml2p:SessionIndex>
</saml2p:LogoutRequest>

Question 2 --> This is more of a SAML configuration question, does Azure send both LogoutRequest and LogoutResponse to configured LogoutURL depending on the IDP initiated or SP initiated workflow?

Since I am seeing LogoutRequest sent back from Azure after the initial LogoutRequest from SP. I am processing that to send back LogoutResponse, I never see terminating LogoutResponse from azure after. Is there some configuration or flow I am missing?

Thanks in advance

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2023-01-04T01:05:50.303+00:00

Hi @photon ,

The application sends the SAML logout request to Azure AD. Then Azure AD logs out the user and sends the SAML Logout Response back to the application.

The logout request also needs to be configured according to this guide:

https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol

https://learn.microsoft.com/en-us/answers/questions/148300/adfs-saml-2-no-redirection-to-the-sp-after-logout.html

Have you followed all of the configuration from the single sign-out SAML guide?
photon 6 Reputation points

2023-01-04T23:12:35.54+00:00

Thanks for the response @Marilee Turscak-MSFT

I have followed the guide you posted. The guide specifically says

If one of the other participants sends a LogoutRequest to the Microsoft identity platform (the session authority), it will send a LogoutRequest back to all the session participants except the participant who sent the initial LogoutRequest.

Issuer
Issuer in the SAML logout request matches the 'Application ID URI' as configured in the manage->Expose An API screen.

SessionIndex matches the session ID I get back in SAML assertion during SSO

In my specific case, I am expecting a SAMLResponse on the configured LogoutUrl, instead of SAMLRequest from Azure as a response to the SAML Logout request.

Thanks!
Sylwester K 0 Reputation points

2024-01-08T17:04:47.3233333+00:00

I'm having a similar issue. I'm using MS Entra ID Enterprise Applications with SAML SSO and I can't get the SLO to work. My Identity Provider initiates a SLO with LogoutRequest and it's expecting a LogoutResponse on the Logout URL I've configured as part of the Enterprise App SSO. Instead of a LogoutResponse I see a LogoutRequest being sent by Entra ID.

I was testing different configuration options and always see the same result.

Your answer

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2023-01-04T01:05:50.303+00:00

Hi @photon ,

The application sends the SAML logout request to Azure AD. Then Azure AD logs out the user and sends the SAML Logout Response back to the application.

The logout request also needs to be configured according to this guide:

https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol

https://learn.microsoft.com/en-us/answers/questions/148300/adfs-saml-2-no-redirection-to-the-sp-after-logout.html

Have you followed all of the configuration from the single sign-out SAML guide?
photon 6 Reputation points

2023-01-04T23:12:35.54+00:00

Thanks for the response @Marilee Turscak-MSFT

I have followed the guide you posted. The guide specifically says

If one of the other participants sends a LogoutRequest to the Microsoft identity platform (the session authority), it will send a LogoutRequest back to all the session participants except the participant who sent the initial LogoutRequest.

Issuer
Issuer in the SAML logout request matches the 'Application ID URI' as configured in the manage->Expose An API screen.

SessionIndex matches the session ID I get back in SAML assertion during SSO

In my specific case, I am expecting a SAMLResponse on the configured LogoutUrl, instead of SAMLRequest from Azure as a response to the SAML Logout request.

Thanks!
Sylwester K 0 Reputation points

2024-01-08T17:04:47.3233333+00:00

I'm having a similar issue. I'm using MS Entra ID Enterprise Applications with SAML SSO and I can't get the SLO to work. My Identity Provider initiates a SLO with LogoutRequest and it's expecting a LogoutResponse on the Logout URL I've configured as part of the Enterprise App SSO. Instead of a LogoutResponse I see a LogoutRequest being sent by Entra ID.

I was testing different configuration options and always see the same result.

Share via

SP initiated SAML SLO Logout URL configuration

Your answer