Security

Why is my SAML (SSO) session not destroyed after logout?

ryangpeng
Explorer

Hello, I have configured SAML auth (SSO) with AD FS on Splunk 6.4.3 and the login function works fine.
The problem is when I clicked "logout", it redirected to a new page showing two lines:

User logged out successfully.
Click here to return to Splunk.

If I click "Click here to return to Splunk.", I will be logged in again without typing username password, which means the SSO session wasn't destroyed.
Anyone knows how to configure to make sure the SSO session is destroyed when I click "logout"?

suarezry
Builder

I suspect your idpSLOUrl is incorrect. Can you look at your ADFS and see what you have configured as your SAML Logout Endpoint? See this screenshot as a reference:
alt text

suarezry
Builder

Are you using splunk's native saml support OR are you using a reverse proxy?

0 Karma

ryangpeng
Explorer

Hi Suarezry, I'm using Splunk's native saml and below are the .conf files. (Sensitive information has been masked).
idpSLOUrl and idpSSOUrl are the same.

[splunk@<host> local]$ cat /opt/splunk/etc/system/local/authentication.conf
[authentication]
authSettings = saml
authType = SAML

[rolemap_SAML]
admin = <*>

[userToRoleMap_SAML]
<*>@<*> = admin

[saml]
allowSslCompression = true
attributeQueryRequestSigned = true
attributeQueryResponseSigned = true
attributeQuerySoapPassword = <pass>
attributeQueryTTL = 3600
caCertFile = /opt/splunk/etc/auth/server.pem
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = <id>
fqdn = https://<fqdn>;
idpSLOUrl = https://<host>/adfs/ls/
idpSSOUrl = https://<host>/adfs/ls/
maxAttributeQueryQueueSize = 100
maxAttributeQueryThreads = 2
redirectPort = 8000
signAuthnRequest = true
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/server.pem
sslKeysfilePassword = <pass>
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2

[splunk@<host> local]$ cat /opt/splunk/etc/system/local/web.conf
[settings]
enableSplunkWebSSL = 1
tools.sessions.timeout = 43200
enableWebDebug = true
mgmtHostPort = 127.0.0.1:8090
SSOMode = permissive

I also found that if I close the browser after logging out, the sso session will be destroyed.
But we may not want to logout this way every time.

0 Karma

suarezry
Builder

I also found that if I close the browser after logging out, the sso session will be destroyed.But we may not want to logout this way every time.

Why not? Single logout does not guarantee that all the different services (aside from splunk) will honor the request. Closing the browser is the ONLY way for the end-user to be sure that they have logged out of ALL the different services they have gained access to.

In my case, I set redirectAfterLogoutToUrl to a page that says "Please quit your browser to complete logout from SSO"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...