1

When a user clicks Logoff on my website, it executes the following .NET code:

public ActionResult SLOService()
{
    // Receive the single logout request or response.
    // If a request is received then single logout is being initiated by the identity provider.
    // If a response is received then this is in response to single logout having been initiated by the service provider.
    bool isRequest = false;
    string logoutReason = null;
    string partnerIdP = null;

    SAMLServiceProvider.ReceiveSLO(Request, out isRequest, out logoutReason, out partnerIdP);

    if (isRequest)
    {
        // Logout locally. RTC applilcation will delete the session here
        Session.Clear();

        // Respond to the IdP-initiated SLO request indicating successful logout.
        SAMLServiceProvider.SendSLO(Response, null);
    }
    else
    {
        // SP-initiated SLO has completed.
        FormsAuthentication.RedirectToLoginPage();
    }

    return new EmptyResult();
}

Users come to our site after logging into their IdP externally, and having required attributes passed and processed within AssertionConsumerService logic (not included in this question). Once we verify attributes passed from the IdP, we allow them into the site.

When they decide to logout, we wouldn't want them to stick around on our site, because they won't be able to get authenticated, and thus use our site. We would instead want them to go back to the IdP and authenticate through there.

Would it be correct for me to redirect them back to the SingleSignOnServiceUrl that they have provided us with?

I apologize for the vague/unclear question, this is an entirely new topic for me so I am still learning the terms and process. Also, I wasn't sure where this question belonged on the StackExchange network.

  • This isn't a full answer 'cause I'm clueless with .NET but there are 2 points that should be taken into consideration: (1) since a logout will be a POST you should always redirect the user to prevent the browser from sending the POST a second time by a user mistake (e.g. F5) (2) if you are redirecting to a URL that the user provided you you are opening a possible attack vector: if someone can tamper with that URL while the user sends it to you, they can make the user visit their website instead of the one from where the user started. – grochmal Sep 27 '16 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.