User not logged out despite SAML SLO redirection
User logs in to the application using SAML authentication. When the user logs out, SAML Single Log Out (SLO) redirection occurs and it seems like the user has logged out. However, Pega application has not logged the user out.
Steps to Reproduce
- Log in to the Pega application using SAML authentication.
- Log out of the application.
- Open the same URL in another tab. The user is logged back in without authentication.
The user was not logged out because the out-of-the-box logout (SLO) option of HTTP redirection was selected and the Microsoft Azure logout location was used. The redirection did not log the user out.
Perform the following local-change:
- Remove the logout location.
- Navigate to the LogOff activity step which has 'SAML logoff when SLO URL is not available'.
- Expand the step and navigate to 'pySAMLLogOffWithoutSLO'.