Single logout is not working with Microsoft ADFS 2.0. Any idea does salesforce supports it, Relay partner is created as per guide
From my notes in studying for the Identity Certification, here's what's in the docs:
To use SLO, the identity provider, service providers, and relying parties must be configured for single sign-on and registered for SLO.
Salesforce supports the following protocols:
- SAML SLO as an identity provider or service provider, initiated by either. (This should describe your situation)
- OpenID Connect SLO as an identity provider or relying party, initiated by either.
You want users to log in to Salesforce, then use connected apps to log in to other services. When they’re ready to log out, they log out from Salesforce (or a configured service provider or relying party) and they’re automatically logged out of all the configured connected apps and services. This behavior can be accomplished with the following:
- SAML SLO for which Salesforce is the identity provider, and registered SAML connected apps are service providers.
- OpenID Connect SLO for which Salesforce is the identity provider, and registered OAuth connected apps are relying parties.
You want users to log in to Salesforce using an external identity provider. The identity provider uses SAML or OpenID Connect to log the users in to a Salesforce org. When the users log out of the identity provider (or Salesforce) session, they’re automatically logged out of both. This behavior can be accomplished with the following:
- SAML SLO when Salesforce is the service provider connected to an external SAML identity provider. (This should describe your situation)
- OpenID Connect SLO when Salesforce is the relying party connected to an external OpenID Connect provider.
When you configure SSO and SLO to an ADFS system with SAML, the above as indicated in bold, is what should be happening. If it's not, you'll need to add more detail to tell us what symptoms you're seeing and where things aren't working for you. You should be seeing the behavior in Example 2. If you're expecting the behavior from Example 1, your configuration is not going to behave that way unless you purchase Identity Connect, which would make Salesforce the Identity Provider.