Why is my SAML (SSO) session not destroyed after logout?

[ryangpeng]

Hello, I have configured SAML auth (SSO) with AD FS on Splunk 6.4.3 and the login function works fine.
The problem is when I clicked "logout", it redirected to a new page showing two lines:

User logged out successfully.
Click here to return to Splunk.

If I click "Click here to return to Splunk.", I will be logged in again without typing username password, which means the SSO session wasn't destroyed.
Anyone knows how to configure to make sure the SSO session is destroyed when I click "logout"?

[suarezry]

I suspect your idpSLOUrl is incorrect. Can you look at your ADFS and see what you have configured as your SAML Logout Endpoint? See this screenshot as a reference:

[suarezry]

Are you using splunk's native saml support OR are you using a reverse proxy?

[ryangpeng]

Hi Suarezry, I'm using Splunk's native saml and below are the .conf files. (Sensitive information has been masked).
idpSLOUrl and idpSSOUrl are the same.

[splunk@<host> local]$ cat /opt/splunk/etc/system/local/authentication.conf
[authentication]
authSettings = saml
authType = SAML

[rolemap_SAML]
admin = <*>

[userToRoleMap_SAML]
<*>@<*> = admin

[saml]
allowSslCompression = true
attributeQueryRequestSigned = true
attributeQueryResponseSigned = true
attributeQuerySoapPassword = <pass>
attributeQueryTTL = 3600
caCertFile = /opt/splunk/etc/auth/server.pem
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
entityId = <id>
fqdn = https://<fqdn>;
idpSLOUrl = https://<host>/adfs/ls/
idpSSOUrl = https://<host>/adfs/ls/
maxAttributeQueryQueueSize = 100
maxAttributeQueryThreads = 2
redirectPort = 8000
signAuthnRequest = true
signedAssertion = true
sslKeysfile = /opt/splunk/etc/auth/server.pem
sslKeysfilePassword = <pass>
sslVerifyServerCert = false
sslVersions = SSL3,TLS1.0,TLS1.1,TLS1.2

[splunk@<host> local]$ cat /opt/splunk/etc/system/local/web.conf
[settings]
enableSplunkWebSSL = 1
tools.sessions.timeout = 43200
enableWebDebug = true
mgmtHostPort = 127.0.0.1:8090
SSOMode = permissive

I also found that if I close the browser after logging out, the sso session will be destroyed.
But we may not want to logout this way every time.

[suarezry]

I also found that if I close the browser after logging out, the sso session will be destroyed.But we may not want to logout this way every time.

Why not? Single logout does not guarantee that all the different services (aside from splunk) will honor the request. Closing the browser is the ONLY way for the end-user to be sure that they have logged out of ALL the different services they have gained access to.

In my case, I set redirectAfterLogoutToUrl to a page that says "Please quit your browser to complete logout from SSO"