How do I hook into IDP initiated single logout to run custom code?

1
votes

I'm using sustainsys.saml2.httpmodule. I would like to run some code to log the logout from an IDP initiated single log out. The user also does not seem to be logged out (IsAuthenticated is still true) after an IDP initiated single log out even though https://stubidp.sustainsys.com/Logout gives me a success result.

I can't seem to find anyone else needing the same functionality or having the same issues. My Sustainsys config is below.

<sustainsys.saml2 entityId="http://localhost:53758/Saml2"
                returnUrl="http://localhost:53758/Common/Pages/Saml2Login.aspx"
                authenticateRequestSigningBehavior="IfIdpWantAuthnRequestsSigned"
                validateCertificates="false"
                publicOrigin ="http://localhost:53758/">
    <nameIdPolicy allowCreate="false" format="Unspecified"/>
    <metadata cacheDuration="PT1440M" wantAssertionsSigned="true">
        <organization name="ab" displayName="ab" url="https://www.example.com/" language="en" />
        <contactPerson type="Technical" email="[email protected]" />
        <requestedAttributes>
            <add friendlyName ="Some Name" name="urn:someName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true" />
        </requestedAttributes>
    </metadata>
    <identityProviders>
    <add entityId="https://stubidp.sustainsys.com/Metadata"
        signOnUrl="https://stubidp.sustainsys.com"
        logoutUrl="https://stubidp.sustainsys.com/Logout"
        allowUnsolicitedAuthnResponse="true"
        binding="HttpRedirect"
        wantAuthnRequestsSigned="true">
        <signingCertificate storeName="CertificateAuthority" storeLocation="CurrentUser"
                        findValue="cdf7090a433561a843b51198b0ba6456" x509FindType="FindBySerialNumber" />
    </add>
    </identityProviders>
    <serviceCertificates>
        <add storeName="CertificateAuthority" storeLocation="CurrentUser" findValue="2cfe21cb930c19a341e9e30a07a3c123" x509FindType="FindBySerialNumber" />
    </serviceCertificates>
</sustainsys.saml2>
1
sustainsys-saml2

1 Answers

0
votes

You can use the LogoutCommandResultCreated notification. It will get called both when the redirect to the Idp is about to happen as well as after the response has been received from the Idp.