Open morissetcl opened 9 months ago
idp_slo_service_url
should be set to an SLO URL that Google gives you, not one local to your application—after signing out of your application, the SP, the user will be redirected there to complete the logout in the IdP. So I think it's not included in your metadata because it's not provided by your application.
I think single_logout_service_url
may be used by Google—when a user signs out of Google, it can send a request to your application to let you know they should also be signed out of your application, the SP. Thus why it's in your metadata, in which case you shouldn't use idp_sign_out
, you should probably use /users/sign_out
.
Hey!
I am trying to use the SLO feature.
For context, I want to disconnect a user from my application who has been logged in via SAML from the Google Workspace UI. Basically, by disconnecting the user from the device tab or resetting the user's login cookies. This works well to disconnect the user from their Gmail, for example, but it's not reflected in the application where they were logged in using SAML.
Below my config
My questions:
/saml/metadata
I haveI will expect to have information related to
idp_slo_service_url
but there is nothing. I went through theruby-saml
gem and I found out that they use thesingle_logout_service_url
settings instead ofidp_slo_service_url
. When I do the change I have the following metadataI have the
SingleLogoutService
info.What do you think about that? Is
single_logout_service_url
should be used instead ofidp_slo_service_url
?idp_slo_service_url
. Should it be an url redirecting to anuniversal logout
action (I use something like this) orusers/saml/idp_sign_out
?Thanks for your help.