Azure AD SSO SingleLogoutService doesn't have POST binding in Federation metadata

2
votes

When tried to integrate a SP(Cognito) with IdP (Azure AD) through SAML federation,

Azure AD SSO SingleLogoutService doesn't have POST binding in the federation metadata. It does only have urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect.

what should we do to add urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST in the metadata. I've went through Azure docs and didn't find one.

Whereas I've tried to integrate ADFS, ADFS metadata have both HTTP-Redirect & HTTP-POST. The SAML Logout Response from IdP is sent to SP as POST and works perfectly.

The Login flow works pretty straight and has no problems at all. Whereas with Logout, IdP accepts SAML Logout Request and provides the SAML Logout Response through GET endpoint which should be a POST binding endpoint that SP accepts.

Is the absence of urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST binding in SingleLogoutService disrupts the Logout?

Does Azure supports only GET for SingleLogoutService? Azure docs doesn't have any reference regarding the binding it supports for Logout. Azure Reference Link

1
azureazure-active-directorysingle-sign-onamazon-cognito

1 Answers

1
votes

I think Azure AD only supports HTTP-Redirect...

See: https://social.msdn.microsoft.com/Forums/SECURITY/en-US/8827db0c-8f7c-4654-a3a8-cc99265f7649/does-azure-ad-support-backchannel-binding-for-saml-slo?forum=WindowsAzureAD

While "backchannel" would typically refer to SOAP requests I'm pretty sure there's no plan to support anything other than HTTP-Redirect.