CODEWITHSUNDEEP
azureazure-active-directorysingle-sign-onamazon-cognito
Sivaram Kumar
Sivaram Kumar

Reputation: 331

Azure AD SSO SingleLogoutService doesn't have POST binding in Federation metadata

When tried to integrate a SP(Cognito) with IdP (Azure AD) through SAML federation,

Azure AD SSO SingleLogoutService doesn't have POST binding in the federation metadata. It does only have urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect.

What should we do to add urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST in the metadata. I've went through Azure docs and didn't find one.

Whereas I've tried to integrate ADFS, ADFS metadata have both HTTP-Redirect and HTTP-POST. The SAML Logout Response from IdP is sent to SP as POST and works perfectly.

The login flow works pretty straight and has no problems at all. Whereas with Logout, IdP accepts SAML Logout Request and provides the SAML Logout Response through GET endpoint which should be a POST binding endpoint that SP accepts.

Is the absence of urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST binding in SingleLogoutService disrupts the logout?

Does Azure support only GET for SingleLogoutService? Azure docs doesn't have any reference regarding the binding it supports for Logout.

Upvotes: 3

Views: 2307

Answers (1)

Kellen Murphy
Kellen Murphy

Reputation: 666

I think Azure AD only supports HTTP-Redirect...

See: https://social.msdn.microsoft.com/Forums/SECURITY/en-US/8827db0c-8f7c-4654-a3a8-cc99265f7649/does-azure-ad-support-backchannel-binding-for-saml-slo?forum=WindowsAzureAD

While "backchannel" would typically refer to SOAP requests I'm pretty sure there's no plan to support anything other than HTTP-Redirect.

Upvotes: 2

Related Questions