Related question: https://stackoverflow.com/questions/47293940/sp-initiated-single-logout-not-working-with-salesforce
I'm implementing single-sign-on service using Salesforce as identity provider. My app is now working well with single login. My goal is to make logout from my app (service provider) initiate log out in the identity provider (salesforce). For this purpose I send SAML2 request to Salesforce, however, I always get "We are unable to log you out." error. I searched logs of salesforce to find the cause of the error but didn't find any. In my app i use django, to generate saml I use pysaml2 lib. This is my code to generate logout request:
req_id, request = saml2_client.create_logout_request(
destination,"<entity-id>",name_id=NameID(text=request.user.email, format=NAMEID_FORMAT_TRANSIENT), expire=soon)
# request = saml2_client.sign(request)
rstate = saml2_client._relay_state(req_id)
msg = http_redirect_message(request, destination, rstate)
headers = dict(msg['headers'])
location = headers['Location']
return HttpResponseRedirect(location)
Generated xml:
<ns0:LogoutRequest
Destination="<logout_endpoint>"
ID="<id>" IssueInstant="2019-08-21T06:44:29Z" NotOnOrAfter="2019-08-
21T06:49:29Z"
Version="2.0" xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion">
<ns1:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-
format:entity">https://localhost:8000/saml2_logout/</ns1:Issuer>
<ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-
format:transient">username</ns1:NameID>
</ns0:LogoutRequest>
I'm not sure if params I pass to create_logout_request are correct, but I couldn't find any guide on what they have to be, currently entityid value is the url of my salesforce identity provider.