SAML 2.0, Single Logout issue

2
votes

I have a question regarding SAML 2.0 and SLO.
During SLO, as an Idp we're initiating the logout and sending a logout request to SP and SP is sending back a logout response. We're getting a partial logout on the IDP side and the user is getting logged out on the IDP side, however if I go back to SP site, I am still logged in.
Is this an issue on the IdP side or the SP side? By that I mean should SP terminate the session and send logout response to IDP or is the IdP's job to terminate the sessions on both side?

Thanks

1
single-sign-onsaml-2.0federated-identity

1 Answers

4
votes

The SP session is the responsibility of the SP. They should kill their session before returning the LogoutResponse to the IdP.