All geek questions in one place

PingFederate Single Log-Off - How Does It Work?

Given:

  • PingFederate is a single sign-on (SSO) solution that allows users to authenticate with 1-n applications using the same username and password.

High level questions:

  • How does the Single-off-off (SLO) function of PingFederate work?
  • And how does SLO work in general?

Given:

  • To begin the SLO process, we expect the user to request the SLO endpoint from the browser (ie https://[PingFederateInstance]/idp/startSLO.ping?PartnerSpId=[PartnerSpId] ).
  • And we can assume that the PingFederate instance will issue a redirect after a successful SLO call.

Concrete questions:

  • But what if you have multiple applications in multiple browser windows?
  • How can a federated identity provider tell multiple applications to end their user sessions?
+4
source share
1 answer

Directly from the PingFederate Getting Started Guide:

“A single sign-off profile (SLO) allows a user to log out of all participating sites in a federated session almost simultaneously. A user can log out globally from any site, be it SP or IdP, as defined by the respective web applications. The corresponding IdP federation deployment will handle all exit requests and answers for participating sites.

However, PingFederate (acting as an IdP) knows which SPs you have joined with in this session. When a user launches SLO (from the example you provided - in IdP - it can also be initiated from SP), the user browser (subject to forwarding or POST binding) is sent to each SP using SAML LogoutRequest.

If in "multiple browser windows" you mean independent browsers / browser sessions, then really PingFederate does not know to exit all IdPs. You should have some general session among them. So, if there are only a few browser windows, but general session information (for example: cookie), this wil works fine.

For more information, you can refer to section 4.4 of the SAML 2.0 Profiles specification: http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf

Remember that PingFederate not only supports SAML 2.0, but not all federation protocols support SLO (for example, SAML 1.x). In addition, many applications that do not support PingFederate SAML do not support SLO.

+3
source

Source: https://habr.com/ru/post/1382578/

More articles:


All Articles