Support Article

User not logged out despite SAML SLO redirection

SA-104768

Summary

User logs in to the application using SAML authentication. When the user logs out, SAML Single Log Out (SLO) redirection occurs and it seems like the user has logged out. However, Pega application has not logged the user out.

Error Messages

Not Applicable

Steps to Reproduce

Log in to the Pega application using SAML authentication.
Log out of the application.
Open the same URL in another tab. The user is logged back in without authentication.

Root Cause

The user was not logged out because the out-of-the-box logout (SLO) option of HTTP redirection was selected and the Microsoft Azure logout location was used. The redirection did not log the user out.

Resolution

Perform the following local-change:

Remove the logout location.
Navigate to the LogOff activity step which has 'SAML logoff when SLO URL is not available'.
Expand the step and navigate to 'pySAMLLogOffWithoutSLO'.
Add the Generic Azure Logoff URL.

<META http-equiv="refresh" content="0;URL=https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0">