1

I'm having trouble getting Salesforce SAML single logout (SLO) working. I'm writing a web application that uses Salesforce as the SAML Identitiy Provider (IdP)

Every LogoutRequest I send gets a response with a StatusCode of "urn:oasis:names:tc:SAML:2.0:status:Responder", which according to the spec means that an error has occurred in Salesforce.

However, I can't find any other details about what might be wrong. There isn't anything in the "Identity Provider Event Log", and no other details in the LogoutResponse. Does anyone know how to debug this issue, or what might be wrong? I've included an example LogoutRequest and the LogoutResponse below:

Request:

<samlp:LogoutRequest
        Destination="https://example.cs13.my.salesforce.com/services/auth/idp/saml2/logout"
        ID="EXAMPLE_ID"
        IssueInstant="2018-05-03T18:18:32Z"
        Version="2.0"
        xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer>
        http://subdomain.example.com
    </saml:Issuer>
    <saml:NameID>
        username@example.com
    </saml:NameID>
</samlp:LogoutRequest>

Response:

<?xml version="1.0" encoding="UTF-8"?>
<samlp:LogoutResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                      Destination="https://localhost/logout/callback"
                      ID="EXAMPLE_ID_2"
                      InResponseTo="EXAMPLE_ID"
                      IssueInstant="2018-05-03T13:59:57.627Z" Version="2.0">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        https://example.cs13.my.salesforce.com
    </saml:Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/>
    </samlp:Status>
</samlp:LogoutResponse>

And here is a screen shot of my connected app settings: enter image description here

  • Do we have a fix for this issue? – Juan Jardim Apr 5 at 11:03
  • I'm afraid I never found one. I worked around it by loading the community logout page in an iframe when I wanted the user to be logged out. e.g. <iframe src="{{YOUR COMMUNITY URL}}/secur/logout.jsp" style="width:0; height:0; border:0; border:none;"></iframe> – J. Doe Apr 8 at 13:09
0

According our development with Salesforce SAML SSO integration, we found each Single Sign On operation can only successfully logout once, and then will returns "urn:oasis:names:tc:SAML:2.0:status:Responder". I believe the Salesforce has some verification logic during the SAML Single Logout processing, it might requires an available session with correct matched NameID or something. However, I cannot find out any related settings in Salesforce to turn it off or make it works as we expected, this needs someone inside to answer the root reason.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.