Hello, I have configured SAML auth (SSO) with AD FS on Splunk 6.4.3 and the login function works fine.
The problem is when I clicked "logout", it redirected to a new page showing two lines:
User logged out successfully. Click here to return to Splunk.
If I click "Click here to return to Splunk.", I will be logged in again without typing username password, which means the SSO session wasn't destroyed.
Anyone knows how to configure to make sure the SSO session is destroyed when I click "logout"?
I suspect your idpSLOUrl is incorrect. Can you look at your ADFS and see what you have configured as your SAML Logout Endpoint? See this screenshot as a reference:
Hi Suarezry, I'm using Splunk's native saml and below are the .conf files. (Sensitive information has been masked).
idpSLOUrl and idpSSOUrl are the same.
[splunk@<host> local]$ cat /opt/splunk/etc/system/local/authentication.conf [authentication] authSettings = saml authType = SAML [rolemap_SAML] admin = <*> [userToRoleMap_SAML] <*>@<*> = admin [saml] allowSslCompression = true attributeQueryRequestSigned = true attributeQueryResponseSigned = true attributeQuerySoapPassword = <pass> attributeQueryTTL = 3600 caCertFile = /opt/splunk/etc/auth/server.pem cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH entityId = <id> fqdn = https://<fqdn>; idpSLOUrl = https://<host>/adfs/ls/ idpSSOUrl = https://<host>/adfs/ls/ maxAttributeQueryQueueSize = 100 maxAttributeQueryThreads = 2 redirectPort = 8000 signAuthnRequest = true signedAssertion = true sslKeysfile = /opt/splunk/etc/auth/server.pem sslKeysfilePassword = <pass> sslVerifyServerCert = false sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2 [splunk@<host> local]$ cat /opt/splunk/etc/system/local/web.conf [settings] enableSplunkWebSSL = 1 tools.sessions.timeout = 43200 enableWebDebug = true mgmtHostPort = 127.0.0.1:8090 SSOMode = permissive
I also found that if I close the browser after logging out, the sso session will be destroyed.
But we may not want to logout this way every time.
I also found that if I close the browser after logging out, the sso session will be destroyed.But we may not want to logout this way every time.
Why not? Single logout does not guarantee that all the different services (aside from splunk) will honor the request. Closing the browser is the ONLY way for the end-user to be sure that they have logged out of ALL the different services they have gained access to.
In my case, I set redirectAfterLogoutToUrl to a page that says "Please quit your browser to complete logout from SSO"