y5g9y (y5g9y) asked a question.
I am trying to implement Single LogOut from my Service Provider using Okta. I have the app configured in Okta. The SSO is working fine. Just that when I am logging out of the application it is not logging me out of Okta as a result if I re login it is just logging me with the same user name without taking me to the log in page.
I am trying to implement Single LogOut from my Service Provider using Okta. I have the app configured in Okta. The SSO is working fine. Just that when I am logging out of the application it is not logging me out of Okta as a result if I re login it is just logging me with the same user name without taking me to the log in page.
I have configured the SLO settings as seen in the picture.
And I have updated the same Signature Certificate as provided by Okta as seen in the picture:
Requirements:
- When I log out, it should log me out of the current application as well as Okta.
- When I re log in, It should ask for credentials.
I tried looking into https://help.okta.com/en-us/Content/Topics/Apps/Apps_Single_Logout.htm
But could not understand what the actual issue was.
When you create a SAML app in Okta, the metadata includes an Okta-generated certificate that is used by the Service Provider to verify the signature of the SAML assertions that Okta generates during user logins for your app.
For Single Log Out (SLO), the process is reversed - the Service Provider sends a signed request to Okta to log out the user. But before Okta takes any action, it has to verify the validity of the SLO request, and it does that by verifying the signature in the log out request. Since it is the Service Provider that signs the SLO request, it is the Service Provider that must provide you with a certificate that Okta can use to verify the SLO requests. That's the certificate you need to load into the Signature Certificate field.