How do I implement the SAML sign-out flow for my application that uses a Cognito user pool?

Resolution

Prerequisites:

• Create a Cognito user pool.
• Create a user pool app client.
• Configure your SAML IdP in your user pool.

Activate SAML sign-out in your SAML IdP

Complete the following steps:

1. Amazon Cognito console.
2. In the navigation pane, choose User pools, and then select your user pool.
3. Choose Social and external providers, and then choose your SAML IdP.
4. In your SAML IdP configuration settings, select Add sign-out flow and Sign SAML requests to this provider. Then, save the configuration.
5. Choose View signing certificate.
6. Choose Download as .crt.
7. Choose Close.

Configure your external IdP to enable sign-out

To configure single sign-out in your Cognito application, refer to your IdP's documentation to activate single sign-out in your SAML application.

When you configure your application, complete the following steps:

1. Upload the .crt file from your Cognito user pool as the signature certificate in your IdP's SAML application configuration.
2. Activate single sign-out in your IdP's configuration.
   Note: Your IdP might refer to single sign-out as single logout (SLO).
3. For your IdP configuration, use the following values:
   For the single sign-out URL, enter https://YourDomain.auth.Region.amazoncognito.com/saml2/logout.
   For the service provider (SP) issuer, enter urn:amazon:cognito:sp:YourUserPoolID.
   Note: Replace YourDomain, Region, and YourUserPoolID with your values. Your IdP must send the SAML LogoutResponse as an HTTP POST request. Cognito then redirects the user to the sign-out URL from the initial request.

Test the single sign-out

Make a GET request to the Cognito /logout endpoint. Make sure to include the client_id and logout_uri parameters in the request.

Example logout URL:

https://YourDomain.auth.Region.amazoncognito.com/logout?client_id=YourAppClientID&logout_uri=YourAllowedSignOutURL

Note: For custom applications, you must remove locally stored tokens or session information from the user's browser, such as localStorage and sessionStorage. The Cognito logout URL clears the Cognito cookie only for applications that use the managed UI.

Related information

Signing out SAML users with single sign-out