Single Logout (SLO) Implementation for Multiple Applications - Solution

[suhasbhole77]

This means your IdP does not send IdP-initiated logout requests when it received IdP initiated logout. This is either a setting that needs to be configured, or they haven't implemented it

Originally posted by @alex-jitbit in #95

Following our previous communication regarding the logout issue across multiple applications, we have successfully implemented Single Logout (SLO) functionality. This enhancement enables users to log out from all connected applications simultaneously by logging out from any one of the integrated applications.

To achieve this, we introduced several enhancements and additional methods in the Saml.cs class.

Key Changes Implemented
In Saml.cs

• Added ClearApplicationSession method to selectively clear SSO-related session variables using prefix-based matching while preserving application-specific session data.
• Created SignoutResponse class to process IdP logout responses, validate logout status, and perform complete session cleanup.
• Added IdpLogoutRequest class to handle IdP-initiated logout requests and extract user and session details.
• Implemented SamlRequestHandler class to orchestrate the logout process, clear sessions, and send SAML logout responses back to the Identity Provider (IdP).
• Created SignoutRequest class to generate SAML logout requests for Service Provider (SP)-initiated logout flows.

On the Service Provider (SP) Side

• Added logout detection logic at the beginning of page load to intercept both IdP logout requests and logout responses through query parameters, and route them to the appropriate handlers.

Benefits

1. Centralized session management across integrated applications.
2. Improved security by eliminating orphaned user sessions.
3. Seamless and consistent logout experience for end users.
4. Full SAML 2.0 compliance with support for both SP-initiated and IdP-initiated Single Logout flows.

This implementation ensures that user sessions remain synchronized across all connected applications, providing a secure and user-friendly authentication experience.

Do let me know if it is helpful and if you you need more details.