.NET Integration Kit

IdP single logout integration

When a PingFederate identity provider (IdP) server receives a single logout (SLO) request, it redirects the user’s browser to the Logout Service URL defined in the IdP OpenToken Adapter configuration. The Logout Service is responsible for removing the user’s local session and redirecting the user’s browser back to PingFederate to complete the logout flow.

Logout flow

The following diagram shows the flow of IdP-initiated SLO, but the architecture would also support SP-initiated SLO:

eol1563995496884

  1. User initiates a single logout request. The request targets the PingFederate server’s /idp/startSLO.ping endpoint.

  2. PingFederate sends a logout requests and receives responses for all SPs registered for the current SSO session.

  3. PingFederate redirects the user’s browser to the IdP application’s Logout Service, passing a resume query parameter.

  4. The Logout Service clears the local user session and any OpenToken cookie, then redirects the browser back to PingFederate using the resume path to display a logout success page.

Processing logout requests

The Logout Service endpoint must:

  1. Remove the user’s local session.

    If your application uses ASP.NET Core cookie authentication, sign out using SignOutAsync and clear the server-side session.

  2. Delete the OpenToken cookie using Agent.DeleteToken

    This is applicable only when the agent is configured with use-cookie=true. If the agent uses query parameter mode, no cookie deletion is necessary.

  3. Redirect back to PingFederate using the resume query parameter to complete the logout flow.

The following code snippet shows how to implement the Logout Service in an ASP.NET Core 8 controller:

using opentoken;

// 1. Clear local session and sign out (if using ASP.NET Core cookie authentication)
HttpContext.Session?.Clear();
await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

// 2. Delete the OpenToken cookie (only applicable when
// use-cookie=true in agent-config.txt)
Agent agent = new Agent("<PATH_TO_FILE>/agent-config.txt");
agent.DeleteToken(Response);

// 3. Redirect back to PingFederate to complete the SLO flow
string? resumePath = Request.Query["resume"];
if (!string.IsNullOrEmpty(resumePath))
{
    string redirectUrl = "<PingFederate-base-url>".TrimEnd('/') + resumePath;
    Response.Redirect(redirectUrl, true);
}

The Logout Service URL must match the Logout Service endpoint configured in the IdP OpenToken Adapter instance in PingFederate.

In ASP.NET Core 8, HttpContext.Session?.Clear() and SignOutAsync replace the legacy Session.Abandon() call used in the older .NET Framework integration.

The Agent.DeleteToken method handles removal of both the primary cookie and the legacy fallback cookie written by the agent.