Collapse
Submit a Service Request
Contact Information for Technical Support
My Service Notifications
Customer Portal logout URL for SSO
Answer ID 12709 |
Last Review Date 09/26/2023
When configuring our identity provider, what do we put for the logout URL for Customer Portal?
Environment:
- Customer Portal 3.x
- Any Oracle B2C Service version
Issue:
We have configured SAML 2.0 Single-Sign-On (SSO) for Customer Portal and Agent BUI with an external identity provider (IdP). We are able to successfully log in through SSO. When we try to log out by pushing the logout button in the IdP, we get an error from the IdP.
Resolution:
- Set the Logout URL for Customer Portal in the IdP to https://<your_interface>/ci/openlogin/logout
- Customer Portal does not support sending a LogoutResponse.
Cause:
The administrator used the logout URL from the service provider metadata for agent authentication. This does not work for Customer Portal. So when the identity provider sent a logout request for BUI and then for Customer Portal, the second request was invalid and caused the error.
Notes:
- By default, /ci/openlogin/logout will redirect to the home page once the contact is logged out.
- You may redirect to another page in Customer Portal by appending its URL stub in the form https://<your_interface>/ci/openlogin/logout/app/answers/list (for example).
- Nowhere in this construction should you have the word "redirect." This is different than redirecting after login with the ACS controller.
- If you want to redirect to an external page, such as a page on your IdP, you must do both of the following:
- Set the configuration setting PTA_EXTERNAL_POST_LOGOUT_URL to the desired URL. For example, https://cx.rightnow.com
- URI-encode the entire address and append it to the logout controller method URL in your IdP: https://<your_interface>/ci/openlogin/logout/https%3A%2F%2Fcx.rightnow.com
- /ci/openlogin/logout redirects to the home page if any of the following are true:
- The contact was not logged in to begin with.
- No URL is specified for redirection.
- A fully-qualified URL was specified, but it does not match PTA_EXTERNAL_POST_LOGOUT_URL.
- Sending POST data to the IdP, such as a LogoutResponse, is not supported. To do this, a custom controller could be implemented. An example outline, SLO.php, is attached to this answer.
- It calls the doLogout method from the Contact model to log out the current user, then checks for success and has space to execute the desired code.
- To use it, you would set the logout URL in your identity provider to the custom controller method endpoint, e.g. https://<your_interface>/cc/SLO/logout
File Attachment
- File Type php SLO.php (2.29 KB)
