SAML 2.0 SingleLogoutService

Owned by Rod Widdowson
Last updated: Nov 25, 2021
1 min read

Advanced Configuration

Note, this is an advanced configuration feature. Most deployments can rely on the shorthand elements.

The SAML 2.0 logout handler implements the SAML 2.0 Browser Single Logout profile. The incoming message may be a <samlp:LogoutRequest> or <samlp:LogoutResponse>.

If the message is a request via a front-channel binding, then the following steps are performed. If an error occurs at any point, an effort is made to respond to the requesting IdP with a <samlp:LogoutResponse>containing the error.

  1. Verification of the information in the request against the active session is done.

  2. Any of this user's sessions being logged out other than the active session are removed from the cache.

  3. Front and back-channel application notification loops are executed.

  4. A <samlp:LogoutResponse> is returned to the requesting IdP. The status indicates whether the SP believes that the logout completely succeeded.

If the message is a request via a back-channel binding, then the following steps are performed:

  1. The request content is used to obtain a list of applicable sessions to remove.

  2. The sessions are removed.

  3. The back-channel application notification loop is executed.

  4. A <samlp:LogoutResponse> is returned to the requesting IdP. The status indicates whether the SP believes that the logout completely succeeded.

If the message is a response, then the SP completes the logout operation by redirecting to the browser to a location preserved by relay state, if any, or the globalLogout template is displayed.

The following Binding values are supported:

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact

  • urn:oasis:names:tc:SAML:2.0:bindings:SOAP

Attributes