4

We have an org + custom developer portal + Customer Community where:

Org does not use MyDomain; Community does use custom Domain forums.foo.com

   # TYPE OF USER    LOGIN TARGET                            LOGIN MECHANISM
   1 Internal        Sales/Service Cloud                     login.salesforce.com
   2 Internal        Customer Community                      Global header
   3 Internal        Developer Portal/Customer Community     SSO via in-house IdP
   4 External        Developer Portal/Customer Community     SSO via in-house IdP 

We're using Federated SSO; internal users have FederationIds to support use case #3

NOTE that SSO is not used to login to Sales/Service Cloud; only the Customer Community.

NOTE Salesforce is the Service Provider in use case 3 and 4

Goal:

  • When user logged in via IdP, Logout should go back to IdP login page
  • When user logged in via login.salesforce.com, Logout should go back to login.salesforce.com

Equally valid, acceptable goal:

  • If internal user, logout goes to login.salesforce.com
  • If external user, logout goes to IdP login page

We have a custom Logout URL in the SSO setup: myIdp.foo.com/saml/logout

When the SSO custom logout page is reached, what we have observed is the HTTP header referrer property (in PROD) is always the same regardless of use case:

   # TYPE OF USER    LOGOUT VIA                            REFERRER
   1 Internal        Sales/Service Cloud Logout            naXX.salesforce.com                    login.salesforce.com
   2 Internal        Customer Community Logout             naXX.salesforce.com
   3 Internal        Customer Community Logout             naXX.salesforce.com
   4 External        Customer Community Logout             naXX.salesforce.com 

Options considered:

  1. We had hoped that if the logout came from the Community forums.foo.com, that the HTTP header referrer would be that domain but it isn't.

  2. Merge fields like $User.UserType aren't allowed in SSO custom logout URLs.

So, since Logout is always going to the custom SSO/IdP logout page, how do we tell it from whence the logout occurred so we can redirect to the relevant login page?

  • I think you'd have to use multiple SAML endpoints to differentiate. As far as I know, if there's a logout URL, it is always used, regardless if the login is IdP- or SP-initiated. – sfdcfox Jan 16 '17 at 18:48
  • @sfdcfox - I'm not sure I follow your suggestion. Use cases 1 and 2 don't even start with SAML SSO so what would be the SAML endpoint to configure? How would SFDC know which SSO config to use? – cropredy Jan 16 '17 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.