Enterprise applications -> SAML logout not working in Edge and Chrome browser

NB 1 Reputation point
2021-05-25T08:29:03.46+00:00

Software: Azure Active Directory -> Enterprise applications -> Own application -> Single Sign-On with SAML -> Logout process
Description: Logout process does not work because of browser policies
Affected browsers: Microsoft Edge 90.0.818.62, Google Chrome 90.0.4430.212
Not affected browser: Mozilla Firefox 88.0.1

Problem description:

The logout process in customer (=own) applications runs in thee steps:

  1. User clicks logout button in customer applicatin, page redirects to https://login.microsoftonline.com for SAML logout with SAML data
  2. https://login.microsoftonline.com processes Azure logout and includes logout page from customer application as embedded iframe to ensure that logout is processed in Azure AND customer application (See: Set up Single Sign-On with SAML -> Logout Url)
  3. https://login.microsoftonline.com redirects with Javascript method "window.location.href" back to customer application

Step 2 and 3 do not work in current Chrome based browsers because of security policies:

Step 2 error in developer console:
Unsafe attempt to initiate navigation for frame with origin 'https://login.microsoftonline.com' from frame with URL [customer application logout URL]'.
The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor has it received a user gesture.
See https://www.chromestatus.com/features/5851021045661696

Step 3 error in developer console:
Uncaught DOMException: Failed to set the 'href' property on 'Location':
The current window does not have permission to navigate the target frame to [customer application index URL].

Result: No logout on customer application and no redirect to customer application. Browser stucks on https://login.microsoftonline.com.

Workaround: User can set browser exception for this case/site. But users will not understand the reason and not do it.

Possible solution (proposal):
Allow customer application site with Content Security Policy (CSP) settings in Microsoft logout page.

99310-image.png

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,275 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.