Agent for SharePoint Guide › Advanced Options › How to Configure Single Logout on SharePoint 2010 › Disable Client Loopback › Leave the Sign-out Service URL Unprotected

Leave the Sign-out Service URL Unprotected

As a policy administrator who manages the polices on the Policy Server, leave the sign-out service URL unprotected. Leaving the sign-out service URL unprotected prevents a security challenge from appearing during the single logout process.

Follow these steps:

1. Click Infrastructure, Agent, Agent Groups.
2. Select the FederationWebServicesAgentGroup name in the agent groups list and click Modify.
3. Click Add/Remove.
4. Select the agent you want to add to the agent group from the list of Available Members, and click the right-facing arrows.
5. Click OK, Submit.
6. Click Policies, Domain.
7. Select FederationWebServicesDomain, and click Modify.
8. Click Realms.
9. Select the public realm and click Modify.
10. Ensure that the Unprotected option is selected in the Default Resource Protection field. If not, select the Unprotected option.
11. Click the Resource Filter field and add the following text:

    /affwebservices/spsignout.jsp
    

12. Click Finish.
13. Repeat Steps 1 through 12 for each policy domain or application policy (EPM) protecting your SharePoint web applications.

    The sign-out service URLs are unprotected. Continue with the next step of leaving the confirmation URL unprotected.

Leave the Confirmation Page Unprotected

As a policy administrator who manages the polices on the Policy Server, the next step in configuring single logout is leaving the confirmation page unprotected.

Leaving the confirmation page unprotected prevents a security challenge from appearing during the single logout process.

Follow these steps:

1. Pick the appropriate procedure for your type of policy from the following list:
   • If you use policy domains, go to Step 2.
   • If you use application policies (EPM), go to Step 4.
2. Leave the confirmation page unprotected in your policy domain with the following steps:
   1. Click Policies, Domain, Realms.
   2. Click Create Realm
   3. Verify that the domain with your SharePoint web applications is selected and then click Next.
   4. Enter a name and optional description for the new realm.
   5. Click the Lookup Agent/Agent Group button, and then add the agent object that protects your SharePoint web applications.
   6. Click the resource filter field, and then add the following text:

      affwebservices/spsignoutconfirmurl.jsp
      

   7. Click the Unprotected option button.
   8. Click Finish.
3. Repeat Steps 2a through 2h for each policy domain protecting your SharePoint web applications.
4. Leave the confirmation page unprotected in your application policy (EPM) with the following steps:
   1. Click Policies, Application, Applications.
   2. Click the edit icon of the application that protects your SharePoint web applications.
   3. Verify that the General tab is selected, and then click Create Component.
   4. Enter a name for the component.
   5. Click the Lookup Agent/Agent Group button, and then add the agent object that protects your SharePoint web applications.
   6. Click the resource filter field, and then add the following text:

      affwebservices/spsignoutconfirmurl.jsp
      

   7. Click the Unprotected option button.
   8. Click OK.
   9. Click Submit.
5. Repeat Steps 4a through 4i for each application policy (EPM) protecting your SharePoint web applications.

   The confirmation pages are unprotected. Have your SharePoint administrator continue with the next step of enabling single logout by running the SharePoint connection wizard.
   

Enable Single Logout by Running the SharePoint Connection Wizard

As an agent owner who is responsible for running the system that hosts the CA SiteMinder Agent for SharePoint, run the SharePoint connection wizard to finish enabling single logout.

Follow these steps:

1. Edit the existing connection using the Connection Wizard with the following steps:
   1. Log in to the server that runs your Agent for SharePoint.
   2. Navigate to the following directory:

      Agent-for-SharePoint_home/sharepoint_connection_wizard
      

   Agent-for-SharePoint_Home

   Indicates the directory where the CA SiteMinder Agent for SharePoint is installed.

   Default: (Windows) [32-bit] C:\Program Files\CA\Agent-for-SharePoint

   Default: (Windows) [64-bit] C:\CA\Agent-for-SharePoint
   Default: (UNIX/Linux) /opt/CA/Agent-for-SharePoint

   1. Do the appropriate step for your operating environment:
      • Windows: Right-click the executable and then pick Run as administrator.
      • Solaris: sh ./ca-spconnect-version_number-sol.bin
      • Linux: sh ./ca-spconnect-version_number-rhel30.bin

      The SharePoint Connection wizard starts.

   2. Click Next.

      The Login Details screen appears.

   3. Enter the following login for the Policy Server.

      Policy Server Name

      Specifies the Policy Server name or IP address.

      Username

      Specifies the Policy Server administrator username.

      Password

      Specifies the Policy Server administrator password.

      Agent Name

      Specifies the Agent-4x. The connection with the Policy Server is established using the details given in the Agent Name.

      Shared Secret Key

      Specifies the shared secret key that is associated with the Agent.

   4. Click Next

      The Select Action screen appears.

   5. Select Edit a SharePoint Connection option.
   6. Click Next.

      The SharePoint Connection Properties screen appears.

   7. Click through the wizard until you reach the Single Logout Configuration screen.
   8. Select the Enabled SignOut check box.
   9. Click the CleanUp URL field and then type the cleanup URLs from all of your protected web applications.

      Note: Separate multiple URLs with semi-colons.

   10. Click the Confirm URL field and type the confirmation pages (URLs) from all of your protected web applications. Use the following examples as a guide:

       http://marketing.example.com/affwebservices/spsignoutconfirmurl.jsp;
       http://development.example.com/affwebservices/spsignoutconfirmurl.jsp
       

       Note: Separate multiple URLs with semi-colons.

   11. Click through the wizard until the Commit Details screen appears.
   12. Click Install.

       The Save Complete screen appears.

   13. Click Done.

   The SharePoint connection wizard closes. Single logout is enabled.