sso saml logout

Question

i'm trying to use SAML directly with IAM Identity center, using the OneLogin python package. (which i regretted already, as it is a nightmare.) i use aws identity source, no external idp.

i got login working, so that's fine.

but for the life of me, i can't make logout work. OneLogin creates an URL for me, with the LogoutRequest in it. which looks okay at a glance, but nobody actually understands SAML. however, invoking that URL simply 303 redirects to the portal start page, and leaves me logged in.

on login, i save nameid, session_index, nameid_nq, nameid_format and nameid_spnq. the logout request is

```

https://app.example.eu/sp
    my.name
    _c3a90355-19...05dca

```

the **app.example.eu** links are what configured in the SAML audience for the application.

thus the URL is like

```https://portal.sso.eu-central-1.amazonaws.com/saml/logout/NzQ4M...c3Yzlj?SAMLRequest=fZLdbp...X6Jtfmf8B&RelayState=https%3A%2F%2Fapp.example.eu```

the relay state is precisely what is defined for the application.

i'm getting no error messages, nothing in the response header that would indicate anything remotely relevant. i see no records in cloudtrail. how do you even troubleshoot this?

re:Post Agent · Answer

I understand your frustration with implementing SAML logout for AWS IAM Identity Center. Let me provide some insights and suggestions to help troubleshoot your issue.

First, it's important to note that when using IAM Identity Center (formerly AWS SSO) with SAML, the logout process is more complex than just sending a logout request. The logout needs to be handled both on the client-side and server-side.

For the client-side, you need to remove the locally stored SSO tokens from the client-side cache. For the server-side, an API call needs to be sent to the IAM Identity Center service to invalidate the corresponding server-side IAM Identity Center sign-in session.

The logout URL you're using (https://portal.sso.eu-central-1.amazonaws.com/saml/logout/...) seems correct as it's pointing to the regional endpoint for IAM Identity Center. However, the 303 redirect you're experiencing suggests that the logout request isn't being processed as expected.

Here are a few things you can try to troubleshoot:

1. Ensure that your SAML application's logout URL is set correctly. It should be in the format: <domain-url>/saml2/logout.

2. Verify that the NameID and SessionIndex in your LogoutRequest match exactly with what was provided in the initial SAML assertion during login.

3. Check if your RelayState is correctly configured. The RelayState should typically point back to your application's URL after logout is complete.

4. Make sure your SAML Identity Provider in IAM is correctly set up with the right metadata.

5. As a best practice, implement a process for users to log out from both Amazon Connect (or whichever AWS service you're using) and your identity provider. This is because the session token remains valid for 12 hours, which could lead to security issues if not properly managed.

6. For debugging, you can use tools like SAML-tracer or other SAML developer tools to inspect the SAML messages being exchanged.

7. Check Amazon CloudWatch Logs for any error messages or relevant information about the logout process.

If you're still unable to resolve the issue, you may need to reach out to AWS Support for further assistance, as they can provide more detailed troubleshooting based on your specific configuration and logs.

Remember, SAML can be complex, and the integration between your application, the identity provider, and AWS services needs to be precisely configured for everything to work correctly.  
**Sources**  
[Logout - AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/PortalAPIReference/API_Logout.html)  
[Configuring your identity provider for single sign-on (SSO) - Research and Engineering Studio](https://docs.aws.amazon.com/res/latest/ug/configure-id-federation.html)  
[Configure SAML with IAM for Amazon Connect - Amazon Connect](https://docs.aws.amazon.com/connect/latest/adminguide/configure-saml.html)

sso saml logout

Add your answer

Relevant content