SiteMinder Agent for SAP Web AS Guide › Configuration for Federation Mode with Federation Manager › Single Logout Configuration for Federation Mode

Single Logout Configuration for Federation Mode

If the Agent for SAP Web AS is operating in Federation mode, we recommend configuring single logout (SLO) as a feature. Single logout results in the simultaneous end of all federated user sessions that are associated with the browser that initiated the logout. Single logout helps ensure that no sessions are left open for unauthorized users to gain access to resources at the relying party. The asserting or the relying party can initiate single logout, and the single logout configuration settings are the same at either side.

For detailed configuration instructions for single logout, see the CA Federation Manager Guide.

To configure single logout between Federation Manager and the SAP Web AS server, note the settings of the following SLO fields:

Location URL

Specifies the URL of the single logout service at the asserting party. This URL is where the relying party sends its SLO request.

SLO Confirm URL

Specifies the URL where the user is redirected when the single logout process is complete.

For the SiteMinder Agent for SAP Web AS, enter the URL of the SAP Web AS logoff page. The SLO Confirm URL helps to ensure that the single logout initiated from Federation Manager, the logs out the user from the Federation Manager session. The URL also helps ensure that the associated SAP cookie is invalidated.

This URL must be accessible to the local site if SLO is initiated from your local site. This URL must also be a local resource and not a resource in a federated partner domain. For example, if the local domain is acme.com and your partner is example.com, then the SLO Confirm URL must be in acme.com.

Relay State Overrides SLO Confirm URL

Replaces the URL in the SLO Confirm URL field with the value of the Relay State query parameter in the single logout request.

This check box gives you more control over the single logout confirmation target because using the Relay State query parameter lets you dynamically define the confirmation URL for SLO requests.

Note: Some Federation Manager configuration settings are in different dialogs depending on the Federation Manager version. For the exact location of the configuration settings, consult the CA Federation Manager Guide and UI online help for your version of Federation Manager.