We have an org + custom developer portal + Customer Community where:
Org does not use MyDomain
; Community does use custom Domain forums.foo.com
# TYPE OF USER LOGIN TARGET LOGIN MECHANISM 1 Internal Sales/Service Cloud login.salesforce.com 2 Internal Customer Community Global header 3 Internal Developer Portal/Customer Community SSO via in-house IdP 4 External Developer Portal/Customer Community SSO via in-house IdP
We're using Federated SSO; internal users have FederationIds to support use case #3
NOTE that SSO is not used to login to Sales/Service Cloud; only the Customer Community.
NOTE Salesforce is the Service Provider in use case 3 and 4
Goal:
- When user logged in via IdP, Logout should go back to IdP login page
- When user logged in via
login.salesforce.com
, Logout should go back tologin.salesforce.com
Equally valid, acceptable goal:
- If internal user, logout goes to
login.salesforce.com
- If external user, logout goes to IdP login page
We have a custom Logout URL in the SSO setup: myIdp.foo.com/saml/logout
When the SSO custom logout page is reached, what we have observed is the HTTP header referrer property (in PROD) is always the same regardless of use case:
# TYPE OF USER LOGOUT VIA REFERRER 1 Internal Sales/Service Cloud Logout naXX.salesforce.com login.salesforce.com 2 Internal Customer Community Logout naXX.salesforce.com 3 Internal Customer Community Logout naXX.salesforce.com 4 External Customer Community Logout naXX.salesforce.com
Options considered:
We had hoped that if the logout came from the Community
forums.foo.com
, that the HTTP header referrer would be that domain but it isn't.Merge fields like
$User.UserType
aren't allowed in SSO custom logout URLs.
So, since Logout is always going to the custom SSO/IdP logout page, how do we tell it from whence the logout occurred so we can redirect to the relevant login page?