Federation Security Services Guide › Configure SiteMinder as a SAML 2.0 Identity Provider › Configure Single Logout (optional)

Configure Single Logout (optional)

The single logout protocol (SLO) results in the simultaneous end of all sessions for a particular user, thereby ensuring security. These session must be associated with the browser that initiated the logout. Single logout does not necessarily end all sessions for a user. For example, if the user has two browsers open, that user can establish two independent sessions. Only the session for the browser that initiates the single logout is terminated at all federated sites for that session. The session in the other browser will still be active. Single logout is triggered by a user-initiated logout.

Note: SiteMinder only supports the HTTP-Redirect binding for the single logout protocol.

By configuring the settings on the SLO tab you are informing the Identity Provider whether the Service Provider supports the single logout protocol, and if so, how single logout is handled.

If you enable single logout, you must also:

• Enable the session server at the Identity Provider using the Policy Server Management Console.
• Configure persistent sessions for the realm containing the protected resources at the Service Provider. Persistent session are configured via the FSS Administrative UI.

To configure single logout

1. Log in to the FSS Administrative UI and access the SAML Service Provider Properties dialog box for the Service Provider you want to configure.
2. From the SAML Service Provider Properties dialog box, select the SLO tab.
3. Select the HTTP-Redirect checkbox to enable single logout.

   The remaining fields become active.

4. Enter values for the remaining fields, noting the following:

   Validity Duration

   Specifies the number of seconds that a single logout request is valid. This property is different from the Validity Duration on the SSO tab, which is for assertions. If the validity duration expires, a single logout response is generated and is sent to the entity who initiated the logout. The validity duration also depends on the skew time (set in the General tab) to calculate single logout message duration.

   SLO Location URL, SLO Response Location URL, and SLO Confirm URL

   Entries for these fields must start with https:// or http://.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

5. (Optional) Select the Reuse Session Index field to use the same session index for assertions sent to the same partner during one browser session. This option helps ensure single logout is successful with all third-party partners.

Federation Web Services redirects the user to the logout confirm page after the user’s session is completely removed at the Identity Provider and all Service Provider sites.

More Information:

Single Logout Request Validity

Single Logout Request Validity

The SLO validity duration and Skew Time instruct the Policy Server how to calculate the total time that the single logout request is valid.

Note: The SLO Validity Duration is a different value from the SSO Validity Duration.

The two values that are relevant in calculating the logout request duration are referred to as the IssueInstant value and the NotOnOrAfter value. In the SLO response, the single logout request is valid until the NotOnOrAfter value.

When a single logout request is generated, the Policy Server takes its system time. The resulting time becomes the IssueInstant value, which is set in the request message.

The Policy Server determines when the logout request is no longer invalid. The Policy Server takes its current system time and adds the Skew Time plus the SLO Validity Duration. The resulting time becomes the NotOnOrAfter value. Times are relative to GMT.

For example, a log out request is generated at the Identity Provider at 1:00 GMT. The Skew Time is 30 seconds and the SLO Validity Duration is 60 seconds. Therefore, the request is valid between 1:00 GMT and 1:01:30 GMT. The IssueInstant value is 1:00 GMT and the single logout request message is no longer valid 90 seconds afterward.

Guidelines for the Single Logout Confirmation Page

To support single logout, have a logout confirmation page at your site. This page lets the user know they are logged out.

The logout confirmation page must satisfy the following criteria:

• If the single logout is initiated at the Service Provider, the logout confirmation page must be an unprotected local resource at the Service Provider site.
• If single logout is initiated at an Identity Provider site, the logout confirmation page must be an unprotected local resource at the Identity Provider site.
• The page cannot be a resource in a federation partner domain. For example, if the local domain is ca.com, the SLO confirmation page cannot be in the example.com domain.

To receive feedback about a logout failure, the logout confirmation page must also support the following requirements:

• Be able to handle Base 64-encoded data and read cookies.
• Contain code that looks for a SIGNOUTFAILURE cookie. This condition must be met by the logout page at the IdP and the SP. If single logout fails, the cookie is set in the browser. The cookie contains the Partner IDs of the federation sites where logout failed. These IDs are base 64-encoded. If multiple IDs are listed, they are separated by a space character.

  By configuring the logout confirmation page to look for this cookie, the page can inform the user where the logout failed. This information is useful in networks where a user is logging out from multiple partner sites.

  Additionally, if the SIGNOUTFAILURE cookie is found, the logout confirmation page must inform users to close the web browser to remove all session data.