When user signs out from SAML Service provider, it does not logs out user from the Salesforce Identity provider

Question

I am doing SSO between Salesforce and Drupal using Salesforce as Identity provider and Drupal as Service provider using SimpleSAMLPHP. When user signs out from the Drupal web site, it is not getting logged out from the Salesforce.

To solve the issue, I used 'SingleLogoutService' as https://salescloud--OptusFull.cs13.my.salesforce.com/secur/logout.jsp in Drupal Service provider. But the issue here is that the log out process now ends up with Salesforce login page and I did not find a way to redirect it to the Drupal site. Is there any way to redirect user back to Drupal site.

Please find the metadata information from metadata/saml20-idp-remote.php

    $metadata['https://salescloud--OptusFull.cs13.my.salesforce.com'] = array (
      'entityid' => 'https://salescloud--OptusFull.cs13.my.salesforce.com',
      'contacts' =>
      array (
      ),
      'metadata-set' => 'saml20-idp-remote',
      'expire' => 1739182548,
      'SingleSignOnService' =>
      array (
        0 =>
        array (
          'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
          'Location' => 'https://salescloud--OptusFull.cs13.my.salesforce.com/idp/endpoint/HttpPost',
        ),
        1 =>
        array (
          'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
          'Location' => 'https://salescloud--OptusFull.cs13.my.salesforce.com/idp/endpoint/HttpRedirect',
        ),
      ),
     'SingleLogoutService' => 'https://salescloud--OptusFull.cs13.my.salesforce.com/secur/logout.jsp',
       'ArtifactResolutionService' =>
      array (
      ),
      'keys' =>
      array (
        0 =>
        array (
          'encryption' => false,
          'signing' => true,
          'type' => 'X509Certificate',
          'X509Certificate' => 'MIIErDCCA.....',
        ),
      ),
    );

identigral identigral · Accepted Answer · 2015-02-17T00:06:28

There's a setting in Salesforce that controls the page where the user lands after logout via the identity provider. The setting is under Security Controls > Single Sign-On Settings -> - Identity Provider Logout URL . This setting will only appear in your SF production org if you have My Domain turned on.

When user signs out from SAML Service provider, it does not logs out user from the Salesforce Identity provider

2 Answers