I have a single sign on functionality in my site with Salesforce as identity provider.

I have a saml enabled connected app in Salesforce, also it was single logout enabled.

I'm done with sign on, but i didn't understand how to logout the Salesforce identity provider when I logout from my application.

How can initiate the Salesforce logout from my .net application?


You'll want to follow the instructions in the documentation found at Configure SAML Settings for Single Logout When Salesforce Is the Identity Provider.

When Salesforce is the identity provider connected to an external SAML service provider, users log in to Salesforce. Salesforce uses SAML to log in users to the service provider through a connected app. When users log out of the service provider or the Salesforce session, they’re logged out of both.

You'll need the following:

  • Enable My Domain.
  • Make sure that the service provider supports SAML single logout (SLO).
  • Get the SAML SLO endpoint from the service provider.
  • Get the HTTP binding type from the service provider.

This implementation uses connected apps. You can configure SLO when you create and edit a connected app as a developer and distribute it to other orgs. Or you can create and manage SLO for a connected app within your org as an administrator. When you’re editing a connected app as a developer, your changes to the SLO configuration aren’t propagated to the page. As you change settings through connected app management pages, manually copy settings to the app creation page, if desired.

  1. For an existing connected app: In Setup, enter apps in the Quick Find box, then select Manage Connected Apps.
  2. Next to the connected app that you want to configure for SLO, click Edit. You are now editing the connected app configuration even though the path is through Manage Connected Apps
  3. Under SAML Service Provider Settings, select Enable Single Logout. SAML Service Provider Settings Dialogue
  4. For Single Logout URL, enter the SAML SLO endpoint of the connected app service provider. The URL must start with https://.
    • When Salesforce initiates the logout, it sends the logout request with the session index parameter to this SLO endpoint.
    • When the service provider initiates the logout, Salesforce sends the logout response to this SLO endpoint.
  5. Select the HTTP binding type for SLO. The binding type determines where to put the logout request or logout response in the SAML request. The value is base64 encoded. The service provider gives you this information.

    HTTP Redirect – in the query string, deflated.

    HTTP POST – in the POST body, not deflated.

  6. Provide your service provider with the Salesforce identity provider SLO endpoint. With this endpoint, the service provider can initiate SLO. Under SAML Login Information on the Connected App Detail page, it’s listed in the Single Logout Endpoint and the SAML Metadata Discovery Endpoint. The format for the endpoint is

    https://.my.salesforce.com/services/auth/idp/saml2/logout, where is your org’s My Domain name. Connected App Detail Page SLO Endpoint

  • Hey Thanks looking into this, I configured everything in salesforce, my question is how to call this logout endopint in my service provider application( Asp.net web application).
    – Naresh Ede
    Feb 18 '19 at 7:51
  • That would seem to be dependent on your service provider. You'd need to talk to your service provider for help with that. We can only help you with how to configure Salesforce here. If your SP doesn't have support to help you, try the ASP Forum on Stack Overflow.
    – crmprogdev
    Feb 18 '19 at 13:26
  • It would be great if the documentation on Salesforce contained a working example of an SLO SAMLRequest. I haven't been able to find anything of the sort on the Salesforce documentation. As a developer wanting to send an SLO request to a Salesforce based IDP i've found this very frustrating.
    – Ben Call
    Sep 11 '19 at 19:06
  • @BenCall Go to [Single Sign-On Implementation Guide - Single Logout - Congig SAML)[developer.salesforce.com/docs/atlas.en-us.sso.meta/sso/… and you'll find everything you need to set this up in a Sandbox Org or other org to test it out. I've done it myself in sandbox orgs. Also look at some of the Identity TrailHead Badges which I think also cover this as part of SSO. I'm pretty certain it's in the Identity Super Badge.
    – crmprogdev
    Sep 12 '19 at 13:13
  • @crmprogdev This is comping from the perspective of an SP (third party... not the salesforce org) that wants to single log out of a Salesforce IDP with no access to the salesforce org. For other things I've had to sign up for a demo account an example sso just so I can tell the IDP (salesforce based) what I need. We have been given some basic information about the SP info and enpoints that they setup and that is it.
    – Ben Call
    Sep 12 '19 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.