IDP initiated SLO not working

0
votes

I am using SAML based SSO for my application where IDP role is played by OpenAM. I have tested SP based SSO,SLO and IDP based SSO, all are working fine, but IDP based SLO is not working, when a user is logging out of IDP, I am getting a notification in my SP, but this request do not contain any user information or browser cookies, so wondering about two things:

  1. Is these notification happening back channeled?
  2. If not, how can I fetch my SP side session and invalidate when such notification comes?

also if their some sample implementation available in Java?

1
samlsaml-2.0openamopenssoopensaml

1 Answers

0
votes

the request flow depends on the profile being used / configured ... see SAML profile spec section 4.4.

It's up to the SP how the SLO is handled, e.g. Spring Security based SAML SP has a bug where the local session is not clean up correctly (if you use this see my workaround on Spring JIRA).