.NET Integration Kit

SP single logout (SLO)

When a PingFederate service provider (SP) server receives a single logout (SLO) request, it redirects the user’s browser to the Logout Service URL configured in the SP OpenToken Adapter instance. The redirect includes both an OpenToken containing user attributes and a resume query parameter that the Logout Service must use to redirect back to PingFederate once the local session is cleared.

A user can have multiple sessions. This logout sequence occurs for each session controlled by the SP PingFederate server.

kcs1563995501655

  1. PingFederate receives a SLO request under the SAML 2.0 protocol.

  2. PingFederate, using the OpenToken Adapter, redirects the browser to the Application Server’s Logout Service.

  3. The Logout Service clears the local user session and redirects back to PingFederate using the resume path, indicating that logout was successful.

The code required for SP SLO is identical to that for IdP SLO. The Logout Service endpoint must:

  1. Remove the user’s local session.

    If your application uses ASP.NET Core cookie authentication, sign out using SignOutAsync and clear the server-side session.

  2. Delete the OpenToken cookie using Agent.DeleteToken

    This is applicable only when the agent is configured with use-cookie=true. If the agent uses query parameter mode, no cookie deletion is necessary.

  3. Redirect back to PingFederate using the resume query parameter to complete the logout flow.

// 1. Delete the OpenToken cookie (only applicable when use-cookie=true in agent-config.txt)
Agent agent = new Agent("<PATH_TO_FILE>/agent-config.txt");
agent.DeleteToken(Response);

// 2. Clear local session and sign out (if using ASP.NET Core cookie authentication)
HttpContext.Session?.Clear();
await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

// 3. Redirect back to PingFederate to complete the SLO flow
string? resumePath = Request.Query["resume"];
if (!string.IsNullOrEmpty(resumePath))
{
    string redirectUrl = "<PingFederate-base-url>".TrimEnd('/') + resumePath;
    Response.Redirect(redirectUrl, true);
}