I've successfully tested SSO login against Azure AD / O365 using the approach illustrated on this developer.force.com post, which uses OpenID Connect.
However, I've been unable to successfully log out (end the session) when user clicks log out. The users salesforce session remains active even after clicking 'log out', and a user can simply click on a record in an open tab and they will be immediately re-authenticated, without requiring them to enter their credentials.
Per the Azure 2.0 docs, I should redirect the user to the v2.0 endpoint to sign out
When you want to sign out the user from your app, it isn't sufficient to clear your app's cookies or otherwise end the user's session. You must also redirect the user to the v2.0 endpoint to sign out. If you don't do this, the user re-authenticates to your app without entering their credentials again, because they will have a valid single sign-in session with the v2.0 endpoint.
The documentation includes "GET" before the url, but is not particularly clear on what exactly they are expecting.
And, in the 2.0 endpoint limitations documentation, it indicates that
The OpenID Connect end_session_endpoint parameter, which allows an app to end the user's session, is not available with the v2.0 endpoint.
Given the lack of clarity, I've tried testing a number of possibilities with little success.
- Created button on VF Page that does HTTP GET against the provided end_session_endpoint url (https://login.microsoftonline.com/common/oauth2/v2.0/logout)
This returns as SUCCESS, but does not do anything. User is still logged in afterwards.
CALLOUT_REQUEST|[14]|System.HttpRequest[Endpoint=https://login.microsoftonline.com/common/oauth2/v2.0/logout, Method=GET]
CALLOUT_RESPONSE|[14]|System.HttpResponse[Status=OK, StatusCode=200]
- Setting the end_session_endpoint as the logout URL in session settings
This takes the user to a microsoft page where, once they click their username, will sign them out. It does not sign them out automatically. And, most unintuitively, the title of the page says 'sign in'.
So, my question: how do you automatically end a users session when they logout of salesforce when using OpenID connect w Azure?
This seems like something one ought to be able to do! Understand this may be an azure question better suited to StackOverflow, but given that I'm using the Auth. Provider functionality in sfdc, my hunch is that the solution may have some sfdc specific approach.
UPDATE as best as i can tell this was a temporary glitch that has been fixed. it sure looked like a bug. Pointing the logout URL in session settings at the end_session_endpoint URL now properly logs the user out of SFDC, without pausing at the 'select your account' page that inappropriately displayed 'sign in' when it was signing you out.
i'm still testing, but the behavior suddenly changed today and i have not made any changes to my setup.
