Single Sign-On Service › SSO Partnership Federation Guide › Logging Out of User Sessions › Sign-Out Overview (WS-Federation)

Sign-Out Overview (WS-Federation)

Sign-out is the simultaneous termination of all user sessions for the browser that initiated the sign-out. Closing all user sessions prevents unauthorized users from gaining access to resources at the Resource Partner.

Sign-out does not necessarily end all sessions for a user. For example, a user with two browsers open can have two independent sessions. Only the session for the browser that initiates the sign-out is terminated at all federated sites for that session. The session in the other browser is still active.

The Policy Server performs sign-out using a signoutconfirmurl.jsp. This page resides on the Identity Provider system. An Identity Provider partner initiates a sign-out request on behalf of a user. The JSP sends the sign-out request to each site where the user signed on during a given browser session. The user is then signed out.

A user can initiate a sign-out request only at an Identity Provider. The request is triggered by clicking a link that points to the appropriate servlet. The sign-out confirmation page must be an unprotected resource at the Identity Provider site.

Note: The Policy Server only supports the WS-Federation Passive Request profile for sign-out.

Enable WSFED Sign-Out

Requirements to configure sign-out:

• To enable sign-out at the Identity Provider, enable the session store using the Policy Server Management Console.

  For information about the session store, see the Policy Server Administration Guide.

• Sign-out requires a valid SiteMinder persistent session. which is established during Single Sign-on. Configure persistent sessions for the realm with the protected resources, including the authentication URL, at the Resource Partner.

  For information about realms, see the Policy Server Configuration Guide.

Follow these steps:

1. Log in to the CSP console.
2. Select the WS-Federation partnership that you want to modify.
3. Navigate to the Single Sign-on and Sign-Out step of the partnership wizard.
4. In the Sign-Out section, set the following fields:
   • Enable Sign Out
   • Sign-Out Confirm URL (IP only)
   • Sign-Out URL

   The URLs must each have an entry that starts with https:// or http://.

5. Navigate to the Confirm step and click Finish to save your changes.

Sign-out is configured.