Security

Why is my SAML (SSO) session not destroyed after logout?

ryangpeng
Explorer

Hello, I have configured SAML auth (SSO) with AD FS on Splunk 6.4.3 and the login function works fine.
The problem is when I clicked "logout", it redirected to a new page showing two lines:

User logged out successfully.
Click here to return to Splunk.

If I click "Click here to return to Splunk.", I will be logged in again without typing username password, which means the SSO session wasn't destroyed.
Anyone knows how to configure to make sure the SSO session is destroyed when I click "logout"?

suarezry
Builder

I suspect your idpSLOUrl is incorrect. Can you look at your ADFS and see what you have configured as your SAML Logout Endpoint? See this screenshot as a reference:
alt text

suarezry
Builder

Are you using splunk's native saml support OR are you using a reverse proxy?

0 Karma

ryangpeng
Explorer

Hi Suarezry, I'm using Splunk's native saml and below are the .conf files. (Sensitive information has been masked).
idpSLOUrl and idpSSOUrl are the same.

[splunk@<host> local]$ cat /opt/splunk/etc/system/local/authentication.conf
[authentication]
authSettings = saml
authType = SAML

[rolemap_SAML]
admin = <*>

[userToRoleMap_SAML]
<*>@<*> = admin

[saml]
allowSslCompression = true
attributeQueryRequestSigned = true
attributeQueryResponseSigned = true
attributeQuerySoapPassword = <pass>
attributeQueryTTL = 3600
caCertFile = /opt/splunk/etc/auth/server.pem
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = <id>
fqdn = https://<fqdn>;
idpSLOUrl = https://<host>/adfs/ls/
idpSSOUrl = https://<host>/adfs/ls/
maxAttributeQueryQueueSize = 100
maxAttributeQueryThreads = 2
redirectPort = 8000
signAuthnRequest = true
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/server.pem
sslKeysfilePassword = <pass>
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2

[splunk@<host> local]$ cat /opt/splunk/etc/system/local/web.conf
[settings]
enableSplunkWebSSL = 1
tools.sessions.timeout = 43200
enableWebDebug = true
mgmtHostPort = 127.0.0.1:8090
SSOMode = permissive

I also found that if I close the browser after logging out, the sso session will be destroyed.
But we may not want to logout this way every time.

0 Karma

suarezry
Builder

I also found that if I close the browser after logging out, the sso session will be destroyed.But we may not want to logout this way every time.

Why not? Single logout does not guarantee that all the different services (aside from splunk) will honor the request. Closing the browser is the ONLY way for the end-user to be sure that they have logged out of ALL the different services they have gained access to.

In my case, I set redirectAfterLogoutToUrl to a page that says "Please quit your browser to complete logout from SSO"

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...