Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
BedrockMission!

Learn More

View all

Sign in to view all badges

Initiate SAML logout request at IDP on session timeout on AEM.

Avatar

Avatar
Validate 1
Level 1
eshan_fiction
Level 1

Like

1 like

Total Posts

4 posts

Correct Reply

0 solutions
Top badges earned
Validate 1
Boost 1
View profile

Avatar
Validate 1
Level 1
eshan_fiction
Level 1

Like

1 like

Total Posts

4 posts

Correct Reply

0 solutions
Top badges earned
Validate 1
Boost 1
View profile
eshan_fiction
Level 1

19-06-2017

Hi

I have to logout a user from both AEM application and SAML identity provider after session timeout on AEM. I am using "Apache Jackrabbit Oak TokenConfiguration" to set the time for session time out. But after the session time out occurs at AEM the login request is being initiated from AEM instead of logout request.

How do I achieve this?

Accepted Solutions (1)

Accepted Solutions (1)

Avatar

Avatar
Establish
Community Manager
kautuk_sahni
Community Manager

Likes

1,167 likes

Total Posts

6,285 posts

Correct Reply

1,144 solutions
Top badges earned
Establish
Coach
Originator
Contributor 2
Contributor
View profile

Avatar
Establish
Community Manager
kautuk_sahni
Community Manager

Likes

1,167 likes

Total Posts

6,285 posts

Correct Reply

1,144 solutions
Top badges earned
Establish
Coach
Originator
Contributor 2
Contributor
View profile
kautuk_sahni
Community Manager

22-06-2017

Did you check this post :- Re: AEM SAML integration - logout doesn't go to IDP logout URL ?

What happens here is that when the logout happens if we configure root path ("/") it works because the /system/sling/logout servlet redirects the response to "/" after logout, which is then handled by the SAML Auth Handler.

However when the SAML Auth Handler is not configured with "/", then it will no longer get invoked because the /system/sling/logout servlet still redirects the response to "/" and SAML is not invoked.

Solution :- AuthUtil.setLoginResourceAttribute(request, "/path-configured-in-saml-config").

OR

Create an overlay for the JSP at :

/libs/cq/core/components/login/logout.jsp

In this JSP change the line below:

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html;

to

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html?resource=<the path you configured in the SAML config handler>";

This should convince the method at : https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.core-1.0.6/src/main/java/org/apach..., to set the resource path instead of setting the value to "/"

// find the redirect target from the resource attribute or parameter

// falling back to the reuest context path (or /) if not set

String target = AbstractAuthenticationHandler.getLoginResource(request,

request.getContextPath());

if (target.length() == 0) {

target = "/";

}

~kautuk

Answers (3)

Answers (3)

Avatar

Avatar
Validate 1
Level 1
ankitg2807
Level 1

Likes

0 likes

Total Posts

10 posts

Correct Reply

0 solutions
Top badges earned
Validate 1
View profile

Avatar
Validate 1
Level 1
ankitg2807
Level 1

Likes

0 likes

Total Posts

10 posts

Correct Reply

0 solutions
Top badges earned
Validate 1
View profile
ankitg2807
Level 1

12-05-2021

HI ,

I have configured logout on aem and it is successfully logging out user from aem & Okta , but after logout on Okta, okta submits a SAML Logout response to SingleLogoutService .

This service URL I gave as /content/test/utils/secure/saml_logout , but when response is posted to this endpoint from okta,  it get 500 errror in AEM as below -

 

org.apache.sling.api.resource.PersistenceException: Resource at '/content/test/utils/secure/saml_logout' is not modifiable

Please can you let me know what should be the SingleLogoutService url in AEM to receive OKTA logout response ?

 

Thanks!

Avatar

Avatar
Give Back 10
Level 2
pradeepn6086740
Level 2

Likes

2 likes

Total Posts

16 posts

Correct Reply

0 solutions
Top badges earned
Give Back 10
Give Back 5
Give Back 3
Give Back
Boost 1
View profile

Avatar
Give Back 10
Level 2
pradeepn6086740
Level 2

Likes

2 likes

Total Posts

16 posts

Correct Reply

0 solutions
Top badges earned
Give Back 10
Give Back 5
Give Back 3
Give Back
Boost 1
View profile
pradeepn6086740
Level 2

24-09-2019

Hi kautuk sahni

I am trying to setup SAML config on AEM 6.4 SP2 instance and logout functionality is not working for us. Can you please help me with the changes that needs to be done to make it work.

I am not able to find "/libs/cq/core/components/login/logout.jsp" in AEM 6.4 instance.

Thanks,

Pradeep

Avatar

Avatar
Validate 1
Level 1
eshan_fiction
Level 1

Like

1 like

Total Posts

4 posts

Correct Reply

0 solutions
Top badges earned
Validate 1
Boost 1
View profile

Avatar
Validate 1
Level 1
eshan_fiction
Level 1

Like

1 like

Total Posts

4 posts

Correct Reply

0 solutions
Top badges earned
Validate 1
Boost 1
View profile
eshan_fiction
Level 1

27-06-2017

Thanks for your response Kautuk, appreciate your help.