SAML2 & SLO

[former_member319648]

Hello,

We recently changed our authentication procedure for our SAP netweaver to authenticate user thanks to SAML2 + SAP ID provider.

So far so and all is working fine.

The minor issue we're facing is with the logout option.

When user is clicking on the [Log Off] button (top right corner of the webUi he logout from the system.

The problem is that if user re-open the browser and try to open the webui again then all behaves like if the user never log out.

I mean unless the user clear his broser cache of all cookies then IDP logon screen where he normaly has to provide credential is not dispalyed.

It behaves like if the [Log Off] is not deleting the cookies that was created when he initaly logged in.

Is our expectation wrong?

We would expect that [Log Off] would delete that cookie so user would not be automaticaly reauthenticated but would be redirected to the IDP logon screen.

If our expectation is correct then any idea why it's not behaving like this ?

please advise

thanks

[MSo]

Hi Fabien,

single logout is a combination of service provider and identity provider handshake.

As in your case the user may click on a logout button/link on the service provider side,

then an SLO request is send to the IdP

IdP informs all service providers for which the user was logged in

and terminates the session.

In order to be able to judge why it is not behaving as expected in your scenario it is required to know the concrete application (or service provider) as well as the identity provider.

You stated that you have SAP netweaver and SAP ID provider. Could you explain a bit more concrete which applications you are referring to?

SAP netweaver is an ABAP on-premise application?

SAP ID prvider is SAP Single sign-on (on-premise)  or SAP Cloud Identity (Cloud service)?

Best regards,

Marko Sommer

[former_member319648]

Hello,

Correct.

SAP netweaver is an ABAP on-premise application (= SAP PRM system = a on-premise CRM ABAP system used to manage partner relationships with SAP)

SAP ID provider is SAP Cloud Identity (Cloud service).