The way this is supposed to work is described in the SAML specification.
For one customer, they had 6 RP and one of then didn't do SLO properly and didn't return a logout response.
This stopped all the others getting called, clearing cookies etc. so it was a "half a logout" solution.
Eventually, I simply removed the SLO endpoint for the RP via the ADFS wizard.
Everything then worked correctly.
The RP with issues was still logged in and if you knew the URL you could still continue but at least the bigger picture worked.
I should point out that this RP was the only one that did not use an industry standard SAML stack and had instead tried to roll their own. You may draw your own conclusions :-)
Enjoy!
No comments:
Post a Comment