Initiate SAML logout request at IDP on session timeout on AEM. | Community
Skip to main content
eshan_fiction
New Participant
Jun 20, 2017 3:04 AM UTC
Solved

Initiate SAML logout request at IDP on session timeout on AEM.

Hi

I have to logout a user from both AEM application and SAML identity provider after session timeout on AEM. I am using "Apache Jackrabbit Oak TokenConfiguration" to set the time for session time out. But after the session time out occurs at AEM the login request is being initiated from AEM instead of logout request.

How do I achieve this?

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
kautuk_sahni
kautuk_sahniAccepted solution
Employee
Jun 22, 2017 7:57 AM UTC

Did you check this post :- Re: AEM SAML integration - logout doesn't go to IDP logout URL ?

What happens here is that when the logout happens if we configure root path ("/") it works because the /system/sling/logout servlet redirects the response to "/" after logout, which is then handled by the SAML Auth Handler.

However when the SAML Auth Handler is not configured with "/", then it will no longer get invoked because the /system/sling/logout servlet still redirects the response to "/" and SAML is not invoked.

Solution :- AuthUtil.setLoginResourceAttribute(request, "/path-configured-in-saml-config").

OR

Create an overlay for the JSP at :

/libs/cq/core/components/login/logout.jsp

In this JSP change the line below:

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html;

to

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html?resource=<the path you configured in the SAML config handler>";

This should convince the method at : https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.core-1.0.6/src/main/java/org/apache/sling/auth/core/impl/SlingAuthenticator.java, to set the resource path instead of setting the value to "/"

// find the redirect target from the resource attribute or parameter

// falling back to the reuest context path (or /) if not set

String target = AbstractAuthenticationHandler.getLoginResource(request,

request.getContextPath());

if (target.length() == 0) {

target = "/";

}

~kautuk

Kautuk Sahni
View reply

5 replies

ankitg2807
Level 2
May 12, 2021 10:21 AM UTC

HI ,

I have configured logout on aem and it is successfully logging out user from aem & Okta , but after logout on Okta, okta submits a SAML Logout response to SingleLogoutService .

This service URL I gave as /content/test/utils/secure/saml_logout , but when response is posted to this endpoint from okta,  it get 500 errror in AEM as below -

 

org.apache.sling.api.resource.PersistenceException: Resource at '/content/test/utils/secure/saml_logout' is not modifiable

Please can you let me know what should be the SingleLogoutService url in AEM to receive OKTA logout response ?

 

Thanks!

Translate
pradeepn6086740
Level 2
Sep 24, 2019 10:47 PM UTC

Hi kautuk sahni​

I am trying to setup SAML config on AEM 6.4 SP2 instance and logout functionality is not working for us. Can you please help me with the changes that needs to be done to make it work.

I am not able to find "/libs/cq/core/components/login/logout.jsp" in AEM 6.4 instance.

Thanks,

Pradeep

Translate
eshan_fictionAuthor
New Participant
Jun 27, 2017 5:16 PM UTC

Thanks for your response Kautuk, appreciate your help.

Translate
kautuk_sahni
kautuk_sahniAccepted solution
Employee
Jun 22, 2017 7:57 AM UTC

Did you check this post :- Re: AEM SAML integration - logout doesn't go to IDP logout URL ?

What happens here is that when the logout happens if we configure root path ("/") it works because the /system/sling/logout servlet redirects the response to "/" after logout, which is then handled by the SAML Auth Handler.

However when the SAML Auth Handler is not configured with "/", then it will no longer get invoked because the /system/sling/logout servlet still redirects the response to "/" and SAML is not invoked.

Solution :- AuthUtil.setLoginResourceAttribute(request, "/path-configured-in-saml-config").

OR

Create an overlay for the JSP at :

/libs/cq/core/components/login/logout.jsp

In this JSP change the line below:

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html;

to

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html?resource=<the path you configured in the SAML config handler>";

This should convince the method at : https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.core-1.0.6/src/main/java/org/apache/sling/auth/core/impl/SlingAuthenticator.java, to set the resource path instead of setting the value to "/"

// find the redirect target from the resource attribute or parameter

// falling back to the reuest context path (or /) if not set

String target = AbstractAuthenticationHandler.getLoginResource(request,

request.getContextPath());

if (target.length() == 0) {

target = "/";

}

~kautuk

Translate
Kautuk Sahni
ankitg2807
Level 2
May 12, 2021 10:13 AM UTC

HI ,

I have configured logout on aem and it is successfully logging out user from aem & Okta , but after logout on Okta, okta submits a SAML Logout response to SingleLogoutService .

This service URL I gave as /content/test/utils/secure/saml_logout , but when response is posted to this endpoint from okta,  it get 500 errror in AEM as below -

 

org.apache.sling.api.resource.PersistenceException: Resource at '/content/test/utils/secure/saml_logout' is not modifiable

Please can you let me know what should be the SingleLogoutService url in AEM to receive OKTA logout response ?

 

Thanks!

Translate
Terms & ConditionsAccessibility statement

Loading footer...