I'm having trouble getting Salesforce SAML single logout (SLO) working. I'm writing a web application that uses Salesforce as the SAML Identitiy Provider (IdP)

Every LogoutRequest I send gets a response with a StatusCode of "urn:oasis:names:tc:SAML:2.0:status:Responder", which according to the spec means that an error has occurred in Salesforce.

However, I can't find any other details about what might be wrong. There isn't anything in the "Identity Provider Event Log", and no other details in the LogoutResponse. Does anyone know how to debug this issue, or what might be wrong? I've included an example LogoutRequest and the LogoutResponse below:


        [email protected]


<?xml version="1.0" encoding="UTF-8"?>
<samlp:LogoutResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                      IssueInstant="2018-05-03T13:59:57.627Z" Version="2.0">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/>

And here is a screen shot of my connected app settings: enter image description here

  • Do we have a fix for this issue? Commented Apr 5, 2019 at 11:03
  • I'm afraid I never found one. I worked around it by loading the community logout page in an iframe when I wanted the user to be logged out. e.g. <iframe src="{{YOUR COMMUNITY URL}}/secur/logout.jsp" style="width:0; height:0; border:0; border:none;"></iframe>
    – J. Doe
    Commented Apr 8, 2019 at 13:09

2 Answers 2


You simply have to set the NameID and SessionIndex Attribute from the SSO Login Assertion in the Logout Request as well. I can see from your Logout Request that you are not doing this, so you get the status:Responder which is a slight hint that something went wrong. If you miss those values Salesforce will not know which Session to terminate.


According our development with Salesforce SAML SSO integration, we found each Single Sign On operation can only successfully logout once, and then will returns "urn:oasis:names:tc:SAML:2.0:status:Responder". I believe the Salesforce has some verification logic during the SAML Single Logout processing, it might requires an available session with correct matched NameID or something. However, I cannot find out any related settings in Salesforce to turn it off or make it works as we expected, this needs someone inside to answer the root reason.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .