ADFS 2.0 sign-out failure with SAML2 (protocol) identityprovider

Question

We are using ADFS 2.0 as a federation provider with a identityprovider (claimsprovider) that uses the SAML2 protocol. The relying parties for ADFS uses WS-Federation protocol.

We are now able to request a relying party, sign-in with the SAML2 identityprovider and sign-out so that ADFS sends a sign-out request to the identityprovider wich we then are truly signed-out from.

The problem occurs when we, during the same session (not closing the browser) request a relying party again, sign-in again with the SAML2 identityprovider and then try to sign-out. What happens is that ADFS shows the signed-out page but does not send a sign-out request to the identityprovider so the process stops there (at ADFS). If we then try to sign-in again we, naturally, just "bounce" at the identityprovider as we are still signed-in there.

After the first sign-out (wich always work) this is what happens at all following attempts.

The relationships and protocols are as follows:

RP <---wsfed---> ADFS <---samlp---> IDP

Answer 1

This is down to the browser caching the credentials for the ADFS server. The user is re-authenticating, but they are not being presented for the credentials as the browser remembers them.

After logging out they should be presented with a browser window that informs them to close their browser to securely logout. This is what has to happen to clear the credential cache.