AD FS: How to Invoke a WS-Federation Sign-Out
Summary
In Active Directory Federation Services (AD FS), we support a WS-Federation passive sign-out request to the relying party security token service (RP-STS) which invokes a sign-out from each web application accessed during the current browser session. The identity provider security token service (IP-STS) is also included in the sign-out process. Note: The RP-STS and IP-STS is the same server in WebSSO scenarios where there is no federated partner.
Single-sign-on to the various web applications is maintained via session cookies in the browser, and the WS-Federation sign-out process will destroy these cookies so that the user will need to provide credentials for subsequent access to those applications.
WS-Federation sign-out URL:
https://{DNS_name_of_RP_STS}/adfs/ls/?wa=wsignout1.0
You can optionally provide an additional query string parameter to land the user on a specific page once sign-out is complete.
Query string parameter to use for post-sign-out landing:
wreply={post-sign-out_landing_URL}
Full URL using the wreply parameter:
https://{DNS_name_of_RP_STS}/adfs/ls/?wa=wsignout1.0&wreply={post-sign-out_landing_URL}
Cookies used for WS-Federation sign-out:
AD FS 1.0/1.1 - LSCleanup
AD FS 2.0 - MSISSignOut and MSISSignOutReply (if you use the reply parameter with the request)
When the user has an active session, each accessed resource and the IP-STS will have an entry in the sign-out cookie.
AD FS 2.0 example:
1. The user accessed the web application named ClaimApp: https://adfs2rweb.treyresearch.net:8081/
2. The web application trusts the Trey Research RP-STS: https://adfs2rsts.treyresearch.net/adfs/ls/
3. The user's home realm is Adatum, so we see the IP-STS: https://adfs2asts.adatum.com/adfs/ls/
*The RP-STS URL is not included in the cookie since the RP-STS already knows its own URL, and this is where the WS-Federation sign-out begins.
4. If you take a Fiddler trace during the WS-Federation sign-out, the cookie is base64-encoded, so you'll need to base64-decode its contents to get back to clear text.
Example of base64-encoded cookie:
MSISSignOut=c2lnbm91dDtodHRwczovL2FkZnMyYXN0cy5hZGF0dW0uY29....(cut off for page formatting purposes)
The decoded contents of the sign-out cookie during the active session is the following:
signout;https://adfs2asts.adatum.com/adfs/ls/\signoutCleanup;https://adfs2rweb.treyresearch.net:8081/&ClaimApp&https://adfs2rweb.treyresearch.net:8081/&https://adfs2rweb.treyresearch.net:8081/\
5. When the initial WS-Federation sign-out request is sent to the RP-STS, the RP-STS will first redirect to the IP-STS with a WS-Federation sign-out request. At this same time, the RP-STS sets the sign-out cookie to the user with a new value. The new value no longer contains the IP-STS URL.
The decoded contents of the sign-out cookie after the initial redirect to the IP-STS:
signoutCleanup;https://adfs2rweb.treyresearch.net:8081/&ClaimApp&https://adfs2rweb.treyresearch.net:8081/&https://adfs2rweb.treyresearch.net:8081/\
6. The IP-STS will perform its own WS-Federation sign-out, which will vary by product. If the IP-STS is AD FS 2.0, it will clear out the MSISSignOut cookie that it had originally written to the user.
7. The final step is a request back to the RP-STS: https://{DNS_name_of_RP_STS}/adfs/ls/?wa=wsignoutcleanup1.0
Upon receiving the wsignoutcleanup1.0 request, the RP-STS responds by clearing out the rest of the MSISSignout cookie. Once the sign-out cookie is empty, the user's session has been terminated and the user will either land on an AD FS sign-out page or be redirected to a URL if the wreply parameter was used during the initial sign-out request.
The empty sign-out cookie will look like this:
MSISSignOut=; expires=Tue, 01-Jun-2010 21:01:32 GMT; path=/adfs/ls
More Information
Detailed information on WS-Federation Sign-out:
http://msdn.microsoft.com/en-us/library/bb608217.aspx
Sections: 2.2, 3.4, 5.3