0

Single logout is not working with Microsoft ADFS 2.0. Any idea does salesforce supports it, Relay partner is created as per guide

  • Are you using Identity Connect? If not, did you configure SSO with Salesforce as the idP per the docs in the Salesforce Help? Once you do, you need to follow the other SLO instructions where Salesforce is the idP. – crmprogdev Jun 29 '18 at 12:36
  • We configured it through single sign on setting under set up. Salesforce is not the identity provider, Microsft ADFS is identity provider. We created relay partner etc as per docs. We received federation file from Microsoft ADFS and created relay partner in AD – Neeraj Bhatt Jul 3 '18 at 3:38
0

From my notes in studying for the Identity Certification, here's what's in the docs:

To use SLO, the identity provider, service providers, and relying parties must be configured for single sign-on and registered for SLO.

  1. Salesforce supports the following protocols:

    • SAML SLO as an identity provider or service provider, initiated by either. (This should describe your situation)
    • OpenID Connect SLO as an identity provider or relying party, initiated by either.

Examples:

  1. You want users to log in to Salesforce, then use connected apps to log in to other services. When they’re ready to log out, they log out from Salesforce (or a configured service provider or relying party) and they’re automatically logged out of all the configured connected apps and services. This behavior can be accomplished with the following:

    • SAML SLO for which Salesforce is the identity provider, and registered SAML connected apps are service providers.
    • OpenID Connect SLO for which Salesforce is the identity provider, and registered OAuth connected apps are relying parties.
  2. You want users to log in to Salesforce using an external identity provider. The identity provider uses SAML or OpenID Connect to log the users in to a Salesforce org. When the users log out of the identity provider (or Salesforce) session, they’re automatically logged out of both. This behavior can be accomplished with the following:

    • SAML SLO when Salesforce is the service provider connected to an external SAML identity provider. (This should describe your situation)
    • OpenID Connect SLO when Salesforce is the relying party connected to an external OpenID Connect provider.

When you configure SSO and SLO to an ADFS system with SAML, the above as indicated in bold, is what should be happening. If it's not, you'll need to add more detail to tell us what symptoms you're seeing and where things aren't working for you. You should be seeing the behavior in Example 2. If you're expecting the behavior from Example 1, your configuration is not going to behave that way unless you purchase Identity Connect, which would make Salesforce the Identity Provider.

| improve this answer | |
  • Yes I am setting up it like in example 2. MY identity provider is external ADFS SAML. What details you need ? When I log out from salesforce it is redirected to ADFS and from there it is redirected to a given page. When i again try to login I don't need to give credentials since ADFS is never logging me out – Neeraj Bhatt Jul 12 '18 at 13:33
  • You're telling me that you're not being logged out of the ADFS idP? Does that provider also act as the idP for another Service that you use or only Salesforce? – crmprogdev Jul 12 '18 at 14:02
  • This also acts as an IDP for our in house web application – Neeraj Bhatt Jul 17 '18 at 9:45
  • This also acts as an IDP for our in house web application – Neeraj Bhatt Jul 17 '18 at 9:45
  • @NeerajBhatt Is the in house web application reached through Salesforce or directly through the ADFS idP? If the latter, that would likely be the reason why this is not working, especially if they are not automatically logged out of both when they exit the in house web application. The behavior would need to be consistent. and should actually be set up more like the 1st example which would require a different configuration to access the web apps running as connected apps. – crmprogdev Jul 17 '18 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.