Share via

[AzureAD / SAML / Netscaler] Logout fails

Maarten de Vreeze 1 Reputation point
2020-03-23T09:32:12.29+00:00

I have created an enterprise application for our Citrix ADC (aka: Netscaler).
Login is successful, but the logout fails.

Message:
Sorry, but we’re having trouble signing you in.
AADSTS20012: An error occurred when we tried to process a WS-Federation message. The message was invalid.

After I refresh my browser, then it proceeds successful.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,949 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. GregorNZS 11 Reputation points
    2020-06-24T10:12:55.243+00:00

    Alright, I resolved the issue by setting the 'Logout Binding' on the Netscaler SAML Authentication Server to 'redirect', rather than 'post'. No changes need to be made to the Enterprise App in AAD, the logout URL in the EA can stay blank.

    10490-capture.png

    2 people found this answer helpful.
  2. AmanpreetSingh-MSFT 56,346 Reputation points
    2020-03-24T05:41:08.817+00:00

    @Maarten de Vreeze You need to navigate to Azure AD > Enterprise Applications > Citrix Netscaler > Single Sign-on and set Basic SAML Configuration > Logout URL > https://login.microsoftonline.com/your_tenant_guid/saml2. At the logout, the application should redirect you to this URL with a SAML logout request as query parameter as highlighted below:

    5621-untitled.png

    -----------------------------------------------------------------------------------------------------------

    Please "Accept as answer" wherever the information provided helps you to help others in the community.

    0 comments
  3. GregorNZS 11 Reputation points
    2020-06-24T06:58:16.58+00:00

    I'm also seeing this error. The Netscaler correctly redirects to the logout URL 'https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0' but the browser shows error AADSTS20012. Refreshing the page, logs the session out.

    If I add a logout URL to the enterprise app, https://login.microsoftonline.com/**xxx**/saml2, nothing changes.

    Is there a fix for this?

    0 comments
  4. Maarten de Vreeze 1 Reputation point
    2020-06-24T07:03:50.32+00:00

    I have created a support call for this with Citrix support. Analysis from both Microsoft support and Citrix support, is that the SAML-logout request is malformed. Next step with Citrix support is to upgrade the Netscaler. If error is persistent after upgrade, we will reopen the case.