PingFederate IdP-initiated Logout, redirect to TargetResource - single-sign-on

Ping Federate Logout From IdP flow as from the Ping Federate Documentation
Sequence
User initiates a single logout request. The request targets the
PingFederate server’s /idp/startSLO.ping endpoint.
PingFederate sends a logout request and receives responses from all
SPs registered for the current SSO session.
PingFederate redirects the request to the IdP Web application’s
Logout Service, which identifies and removes the user’s session locally.
The application Logout Service redirects back to PingFederate to
display a logout-success page.
But, I have a slight problem regarding the application Logout Service , which needs to set at IdP adapter configuration.
The problem is i have dynamic logout URL , due to which i can't use it in the Logout Service.
Currently i am trying to initialize the IdP initiated SLO. For which i am passing TargetResource to redirect user to IdP after SLO success.
https://idp.pf.com:9031/idp/startSLO.ping?PartnerSpId=testSpId&TargetResource=http%3A%2F%2Fdynamicsubhost.baseurl.com%3A8080%2Fweb%2Fmy-bank%2Flogout
Question :
So how can i rig the PingFederate setting to skip the Step 3 , so instead of redirecting to the IdP Logout service it redirects to TargetResource.
What i have tried :
I know it sounds cheesy , but actually i kept the IdP logout service to blank. But obviously it wasn't working.
P.S The awkward thing is when i was using same PF server for
configuring both IdP and SP server it was working well. But when i
switch to separate instance of PF server for hosting the PingFederate
Server the consequence is showing up.

You may add the "resume" parameter in your logout service redirect. This is how I implemented it in .NET. I have a web service that handles the SLO and calls this redirect:
Context.Response.Redirect(< SP Server DNS > + Context.Request("resume").ToString(), True)
This redirect will instantiate the Logout service and then redirect back to the value of the targetResource parameter that you specified when you called the logout service.
If your targetResource does not have a value the default SLO URL will be used (this is set in the Admin Console: SP Configuration > APPLICATION INTEGRATION SETTINGS > Default URLs)
For reference: Just review the implementation of the sample application that you may download here
https://www.pingidentity.com/content/dam/pic/downloads/software/integration-kits/-NET-Integration-Kit-2-5-1.zip

Related

Keycloak IDP forwarded auth does not redirect to front-channel logout URL

Situation
For my web application, I have set up a keycloak (v18.0.0) realm with an external SAML IDP.
After successfully logging in, the application is using its own cookies (I can't change this since this is an external piece of software) and has a logout endpoint to destroy those cookies when visited through the browser.
In the corresponding client configuration, I set a front-channel logout URI to be called by the browser whenever a logout is triggered from the IDP.
Problem
When triggering the single sign-out from keycloak itself using this "https://baseurl/realms/my-realm/protocol/openid-connect/logout"`, keycloak successfully logs out from the IDP and destroys its own cookies but does not redirect to the front-channel logout URI, which leaves the app in a logged-in state. I tested this without an IDP enabled and it logged me out from my app.
Question
How can I force keycloak to trigger the front-channel logout URI on a single sign-out request?

ADFS do not forward the Logout request to the Identity Provider, if there is an active SAML session

I have next components:
RP-1 (connected by Ws-Fed, WIF)
RP-2 (connected by SAML, Federation Provider, actially it is another ADFS)
MY-ADFS (ADFS Server 2019 as primary STS)
MY-IP (separate Identity Provider web service, Identity Server 4)
Thus, when I make a sing-out request from RP-1(Ws-Fed), a simple Ws-Fed Logout is formed a request to ADFS:
GET https:/MY-ADFS/adfs/ls/
wtrealm: https://RP-1.com/
wa: wsignout1.0
wreply: https://RP-1.com/logout/
Next ADFS makes redirect to IP:
GET https://MY-IP/WsFederation
wa: wsignout1.0
wreply: https://MY-ADFS/adfs/ls/?redirectContextId=2dd581d2-6e02-4476-915b-a581e3c855d4
thus the user clears the session from ADFS and from IP. - as expected.
However, if before the logout, the transition to SAML RP was made and the SAML session became active, then upon exiting ADFS gives an error:
MSIS7055: Not all SAML session participants logged out properly. It is
recommended to close your browser.
To fix it, I configured the logout endpoint (URL) in the SAML relying party trust as:
https:/RP-2/adfs/ls/?wa=wsignout1.0
With POST binding. After these changes, the error disappeared. But now ADFS no longer does make Logout redirec to to IP, but instead it does a SAML Logout redirect to RP-2:
POST https://RP-2/adfs/ls/?wa=wsignout1.0
SAMLRequest: PHNhbWxwOkxvZ291dFJl
And as a result, Instead of switching to IP, I remain on the RP-2(ADFS also) page where it is written that the exit was successful. However, the user still has an active session (cookies) on the IP side.
Several questions here:
It is not clear why ADFS changes the chain of calls with the SAML active session.
It is not clear how to exclude SAML Logout redirects, or force ADFS to make Logout to IP also.
You will have to add the logout URL in the IP (Identity provider) side as well to ensure that the SAML token generated by signing out from the SaaS application through ADFS is forwarded to the Identity provider and is updated for logout at IP authorization provider end. So that, the cookie on the browser will be updated and sign out will be processed smoothly.
Please find the below probable steps to update the logout URL at the Identity Provider end: -
Open the authentication provider workspace.
Find the logout URL.
Update the URL to the ‘https://RP-2/adfs/ls/?wa=wsignout1.0’ same as that configured in ADFS Server.
Save your changes.
And as for your first query why ADFS changes the chain of calls with SAML active session, it is because the cookies and cache must be removed from the system for successful logout request, thus the logout time as recorded when signing out is updated at the SaaS app end and thus, it is recommended to close the browser let it update in the system also.
Thus, recommend you open both the RP trust apps in different browser windows as both are configured for different token providers.
Please refer the below thread for more information: -
How do you handle the logout process for applications federated with ADFS?
Thanking you,

Problem with Keycloak and logout from SAML identity provider

I have problem with Keycloak's configuration and Single Logout from SAML Identity Provider.
Scenario:
User tries to log into Service Provider using Keycloak's client (OID)
KC redirects to SAML identity provider
Entering correct credentials, user is logged in, KC creates session and user is redirected back to SP page
In another tab user directly logs into IP (no credentials are needed because of SSO)
User logs out from SP
After refresh 2nd tab (IP), user is logged out.
However, if user logs out from IP first, SP session is not closed and user is still logged in:
User logs out from IP (redirect to KC endpoint and return back to IP login page)
After refresh, user is still logged in SP
Keycloak correctly receives samlp:LogoutRequest request and returns <samlp:LogoutResponse
...
samlp:Status<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status></samlp:LogoutResponse>
In KC admin console I can still see there is active session for given client (and user). Actually I can see SAML logout request from IP only in KC stdout (request-dumper filter) but no logout event occured in KC.
I dont really understand in details how SAML works, but shouldn't be user logout from SP using SLO? Or maybe I am missing something in KC's client/realm/IP configuration?
Thank you for your help/explanation
Requirements for Global Logout to work
Clients which are being used for both the service providers should be in the same realm.
When you log out from IdP, do you see a request being fired to logout from each of the service providers? I believe in your case, it is not calling Logout URL for your SP. That needs to be configured at a client level.
If logout URL for SP is being called and if even then you are logged into your SP, then it means that SP has some issues in the implementation of Log out.
When you logout from SP first in that case your SP is sending logout request to IdP and that's why you are being logged out from IdP as well as SP.
But on the other case, I believe Logout URL is not being called (which could be due to missing configuration in the client).
Can you post a screenshot of the configuration to help you better?

How to send assertion from one Service Provider to another Service Provider to enable Single Sign on

I have two service providers(SP) and one common identity provider(IDP).
I can login to both my SP through IDP initiated SSO.
I have same user in both my SP so user lookup is working fine.
After logging in through IDP i have landed in SP1. In SPA i want a link which will be redirected to SP2 landing page without calling the login ti ISP again.
How can i do this?

WSO2 IS Single Logout partially working

I am testing SAML SSO using WSO2 Identity Server 5.0.0 with two PHP application instances as service providers (using onelogin phpsaml). I managed to make the single sign on to work but now I'm facing a problem with single logout.
When I trigger a logout request from the PHPApp1, WSO2 IDP responds
with a logout response and it seems to works fine;
WSO2 IDP triggers a logout request to the saml session particants, in this case to the PHPApp2;
The PHPApp2 handles the logout request and redirect to the WSO2 IDP logout url with the LogoutResponse;
And now the issue: WSO2 does not seems to handle the logout response from PHPApp2 and prints in logs the following message:
WARN {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender} - Failed single logout response from http://php-app2.dev/saml/sls with status code Moved Temporarily {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender}
After that WSO2 keeps trying sending logout requests to the PHPApp2 and ends up with the following message:
ERROR {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender} - Single logout failed after retrying 5 times with time interval 60000 in milli seconds. {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender}
I tried to enable debug logs in WSO2 to obtain more detailed information about the issue but I am not able to get any helpful information.
Is there any way to get more detailed information about this issue?
Any help is welcomed.
Michael, In the SAML Single Logout implementation, when the PHPApp1 initiates the logout, it redirects the user to WSO2 IDP. Then WSO2 IDP validates the LogoutRequest message, after successful validation, WSO2 IDP figure-out the existing session participants (in this case WSO2 IDP will detect PHPApp2). So after session participants are figured, the WSO2 IDP will send Logout Requests to those in stateless way (no browser involvement) and the session participants (PHPApp2) should validate the Logout Requests from the WSO2 IDP and should send the Logout Response back (no browser involvement, no redirections) to the WSO2 IDP. After WSO2 IDP receives all the LogoutResponses back from the all session participants, WSO2 IDP contract it's Logout Response to the initiator which is PHPApp1, this will be sent as a browser redirection (HTTP Form submission).
Well, the problem is due to the fact that onelogin/php-saml implementation handles the IDP Logout request by redirecting the response to the IDP.
I change the code to returns the response instead and it is working now. Considering that I am new to the SAML standards, I am not sure if it is the correct way to solve that.
WSO2 IS works with strong assumptions that servers could see and talk to each other. This way it tries to be polite and sends the logout requests on back channel (server-to-server without user involvement). As the response the SP should send back a valid logout response. The WSO2 IS currently checks only the HTTP status code (200).
SimpleSAMLphp works with user browsers (and assuming the requests are coming from the user) and after receiving the logout request it tries to redirect the user back to IDP with the SAML Response using Redirect-binding. It's issuing HTTP 302 response.
Try to configure the SimpleSAMLphp to use POST binding for logout (in saml20-idp-remote.php). Still - SimpleSAMLphp it may try to redirect the user before returning the form with logout response and WSO2 IS will not follow the redirects.
Gabriel
Make sure you are using a database type session store.
SimpleSAMLphp can then kill the session without the browser context when it receives the LogoutRequest from the remote server directly rather than through a browser redirect.