Trigger ADFS sign-out when using Clavister PAS as relying party (SAML SP)

Warning

Please note, this document is using the legacy authenticators - in order to use the new protocol agnostic authenticators, you need to apply relevant modifications to the configuration examples outlined in this article.

Summary

This document will guide you through the steps to sign out the user from ADFS when using Clavister PAS as a SAML SP (relying party) against ADFS as SAML IdP.

Background

Clavister PAS can be used as a SAML SP against ADFS to trigger ADFS authentication for the user. This is useful in these use cases:

Protect a Clavister web application with ADFS login (using the SAMLServiceProviderAuthN authenticator).
Protect an OpenID Connect RP with Clavister PAS, consuming the authentication from ADFS (using the OIDCToSAMLBroker authenticator)
Protect a SAML SP with Clavister PAS, consuming the authentication from ADFS (using the SAMLSPBroker authenticator)

System Requirements

Clavister PAS 3.2 or higher
Clavister PAS setup as a SAML SP (see use cases above).
Clavister PAS SAML SP setup as a relying party in ADFS.

Instruction

ADFS

Open the AD FS management app on the ADFS server
Relying partys -> Locate the Clavister PAS trust
Doubleclick to open RP properties
Click Endpoints
Click Add SAML
Select SAML Logout
Add trusted url = https://<adfs_server_domain>/adfs/ls/?wa=wsignout1.0
Click OK
Click OK

Clavister PAS

Fetch the ADFS logout URL (On pattern https://<adfs\_server\_domain>/adfs/ls/?wa=wsignout1.0, see above for details.)
Whitelist the logout URL as an allowedLogoutTarget using this instruction.
URL-encode the logout URL (using an online tool). Copy the result. Example result: https%3A%2F%2Fadfs.2019.demo.clavister.com%2Fadfs%2Fls%2F%3Fwa%3Dwsignout1.0
Login to configuration manager. Based on your use case, perform the following changes:
- Protecting a Clavister web application with ADFS login (using the SAMLServiceProviderAuthn authenticator).
  - Advanced->Modules
  - Find the module/application
  - Change/add the parameter logoff_uri with the nextTarget parameter pointing to the logout URL (above).
    
    Example:
```
"logoff_uri": "/activatefido/authenticate/logout/?nextTarget=https%3A%2F%2Fadfs2019.demo.clavister.com%2Fadfs%2Fls%2F%3Fwa%3Dwsignout1.0"
```
    Change the first uri value (in above example /activatefido) to suite your application/module.
  - Click Stage changes and Commit changes
- Protect an OpenID Connect RP with Clavister PAS, consuming the authentication from ADFS (using the OIDCToSamlBroker authenticator)
  - Advanced->OIDC OP
  - Locate your OpenID Connect Provider
  - Change end_session_endpoint = https://<pas_domain>/oidc/authenticate/logout/?nextTarget=https%3A%2F%2F<adfs_domain>t%2Fadfs%2Fls%2F%3Fwa%3Dwsignout1.0 Example:
  - Click Stage changes and Commit changes
- Protect a SAML SP with Clavister PAS, consuming the authentication from ADFS (using the SAMLSPBroker authenticator)
  - Advanced->SAML Identity Providers
  - Locate your SAML IdP used
  - Change/add postSLOURL = https://<pas_domain>/saml/authenticate/logout/?nextTarget=https%3A%2F%2F<adfs_domain>t%2Fadfs%2Fls%2F%3Fwa%3Dwsignout1.0 Example:
  - Click Stage changes and Commit changes

Table of Contents