Single Logout error with Salesforce configured as a SAML Service Provider
Hello,
I'm setting up a single logout functionality between SAML Identity Provider and multiple Service Providers.
All service providers are accepting SLO requests and log out successfully, except application running on Salesforce.
On Identity Provider side I'm using https://myapp2.my.salesforce.com/services/auth/sp/saml2/logout SLO endpoint as per the documentation: https://help.salesforce.com/articleView?id=security_auth_slo_saml_sp_configuring.htm
This is the session index from the IdP SAML response on login to the app running on Salesforce:
SessionIndex="_ikqVdGeBLDs7fSz9EylWyeePncKJr1eu"
This is the SLO request that's sent to Identity provider by logout initiating application (app is not running on Salesforce):
<saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://myidp.example.com/logout" ID="_fbe064a1-07f7-4644-8db1-acf9bdc41c48" IssueInstant="2019-05-20T21:50:28.504Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://myapp1.example.com</saml2:Issuer><saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">test@example.com</saml2:NameID><saml2p:SessionIndex>_pWeWV215PGBTqXAUuA4D1Mt_f7Q7zTtp</saml2p:SessionIndex></saml2p:LogoutRequest>
and this is the logout request that is sent down to Salesforce application by the Identity Provider:
<samlp:LogoutRequest Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
Destination="https://myapp2.my.salesforce.com/services/auth/sp/saml2/logout"
ID="_3170ecdbaf0006476782" IssueInstant="2019-05-20T21:50:28Z" Version="2.0"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">urn:myidp.example.com</Issuer>
<NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">test@example.com</NameID>
<samlp:SessionIndex>_ikqVdGeBLDs7fSz9EylWyeePncKJr1eu</samlp:SessionIndex>
</samlp:LogoutRequest>
The error message after SLO request hits SalesForce endpoint is quite generic and there are no logs to troubleshoot it:
Logout Error: We are unable to log you out. Please contact your administrator for more information
Is there any way to troubleshoot this issue from SalesForce side? At least somehow capture internal error message in SalesForce?
@Identigral Staff thanks for your suggestion.
The SLO request is already signed and SF trusts signing cert because the Login works fine. Signature comes encoded in the URL, and because SF SLO Request binding is set to Redirect, I assume it should work fine:
https://lesmills--test.cs14.my.salesforce.com/services/auth/sp/saml2/logout?SAMLRequest=lZJRa8IwFIX%2FSsl7m6ZadaGW6WRQdGPOIcwXydJUM9uky03F%2FfulLT4MhrDXc8%2B5%2BQ65CbCqrOlKH3RjX8VXI8B62WKK9nwYf%2BRxPI74MIyiMGQjUSBvKwxIraYoCkLkZQCNyBRYpqyTQnLnhxM%2FGr1FhJIxHYx2yFu4jVIx26WO1tZAMS4FVLIswfetGwccyDCovgNgblBow0XAdYVBmLPkAjBr7BFDjVvYCJcdLPIetALRPtwYRTUDCVSxSgC1nG5mTyvqGCnvTbRRUAsuCyly5F2qUgHtqt9O10ZbzXWJ0qTravro7RADB972RWlrA9BB1%2FJauu2W4H5fmjy7fLb4317vUZuK3WhOAtIpMveLzkpFxWQ5y3MjAFDa8jguct%2Bq7e9o01P1NGnSn8XGmd17mcrFJd2vT%2FHd3CdRLOfNunkPD3w3mS9P2%2FnnefBClusE%2F5G6ir8uLP0B&RelayState=7r2m5Hv4Kl0&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=XdQFSQIIGj6%2BE0M1IULj91%2F%2FBYZ9%2FQ0FqsLzjovfVyj58dUnEKjqc1TyIyvWcktDKuiVTvUTTRxhZlcPCyJH0kmtlXdG8oZR2xkGz2DRNcKxqLVw9zb77ktr4XaRbhm%2Bda1mmmdolnq3IBY4BFIjz4wsM1qzpczq5%2F00VYYugpodT4DH3lVn4ftwo7e2PaEfa42lNKjjC58obQpsNGLd6hkEIgEtp9kEYha0uqtCFo9aCtUVrhyQSS78Ed3sDWlBB3gUx8p34tDOjQQKKhLiyimJx8f5i9gkZ%2BiBbpVg3Rj%2F8HlJSqDxLR%2F%2BZJwpzxiuzwZQMfPpr0NFgYfYIc6Dxw%3D%3DEverything looks OK to me, including SessionIndex which is the same in Login Response and Logout Request.
I have attached is Login response and SLO request which errors out on SF side.
