We have an org + custom developer portal + Customer Community where:
Org does not use
MyDomain; Community does use custom Domain
# TYPE OF USER LOGIN TARGET LOGIN MECHANISM 1 Internal Sales/Service Cloud login.salesforce.com 2 Internal Customer Community Global header 3 Internal Developer Portal/Customer Community SSO via in-house IdP 4 External Developer Portal/Customer Community SSO via in-house IdP
We're using Federated SSO; internal users have FederationIds to support use case #3
NOTE that SSO is not used to login to Sales/Service Cloud; only the Customer Community.
NOTE Salesforce is the Service Provider in use case 3 and 4
- When user logged in via IdP, Logout should go back to IdP login page
- When user logged in via
login.salesforce.com, Logout should go back to
Equally valid, acceptable goal:
- If internal user, logout goes to
- If external user, logout goes to IdP login page
We have a custom Logout URL in the SSO setup:
When the SSO custom logout page is reached, what we have observed is the HTTP header referrer property (in PROD) is always the same regardless of use case:
# TYPE OF USER LOGOUT VIA REFERRER 1 Internal Sales/Service Cloud Logout naXX.salesforce.com login.salesforce.com 2 Internal Customer Community Logout naXX.salesforce.com 3 Internal Customer Community Logout naXX.salesforce.com 4 External Customer Community Logout naXX.salesforce.com
We had hoped that if the logout came from the Community
forums.foo.com, that the HTTP header referrer would be that domain but it isn't.
Merge fields like
$User.UserTypearen't allowed in SSO custom logout URLs.
So, since Logout is always going to the custom SSO/IdP logout page, how do we tell it from whence the logout occurred so we can redirect to the relevant login page?