After sending a SAML logout request to OKTA, the user remains logged in to the IdP

Hi @BrianS.54488 (Customer)​ , Thank you for reaching out to the Okta Community! 

You are experiencing a SAML Single Logout (SLO) failure where after sending a signed logout request to Okta, the user remains logged in to the IdP and receives a RequestDenied status code in the LogoutResponse, despite Single Logout being enabled and the SessionIndex and NameID matching between the login and logout requests.

The most common causes of RequestDenied responses during SAML SLO are signature validation failures or certificate mismatches between your Service Provider configuration and Okta's expectations.

Root Cause:

SAML logout requests must be cryptographically signed and validated by Okta. If the signature on your logout request does not validate against the certificate Okta has on file for your application, Okta will deny the logout request without logging a detailed error in the standard UI reports. This is a security measure to prevent unauthorized logout attempts.

Solution:

Follow these troubleshooting steps:

1. Check the System Logs for SLO events — Navigate to Admin Console → Reports → System Log and search for the event type user.authentication.slo. This log entry will show whether the logout request was received and may contain additional error details not visible in the standard application reports.
2. Verify the signing certificate — Confirm that the certificate you are using to sign the logout request matches the certificate Okta has configured for your SAML application. In the Admin Console, go to Applications → Your App → Sign On tab and verify the certificate under the SAML Signing Certificates section matches what your SP is using.
3. Validate the logout request signature — Using SAML-tracer or similar tools.  
4. Check the signature algorithm — Ensure the signature algorithm used to sign your logout request (e.g., RSA-SHA256) matches the algorithm configured in your Okta SAML application settings. Mismatched algorithms will cause signature validation to fail.
5. Verify the Destination attribute — Confirm that the Destination attribute in your LogoutRequest exactly matches the Single Logout Service URL configured in Okta for your application. Any mismatch will cause the request to be rejected.
6. Review the SLO configuration — In the Admin Console, navigate to Applications → Your App → General tab and confirm that Allow application to initiate Single Logout is enabled. Also verify the Single Logout Service URL (Recipient URL) is correct.

If the system logs still show no detailed error after verifying the above, or if the issue persists, contact Okta Support with the System Log entries for the failed SLO attempt and the raw LogoutRequest and LogoutResponse XML for further investigation.

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added