How To: Migrate from SLO VAM to Native Single Logout in 24.04

Version Affected: 24.04

 

Overview

This article explains how to migrate a realm from SLO VAM (the Virtual Appliance Module implementation of Single Logout) to native Single Logout, which is built into SecureAuth Identity Platform starting in 24.04. SLO VAM is not tested against 24.04, so realms using it must migrate to the native feature. If you're still running SAML Logout VAM and troubleshooting it instead, see Troubleshooting: SAML Logout VAM Setup Common Issues.

Migrate from SLO VAM to Native Single Logout

1. Decrypt the realm's web.config and create a backup copy of it before making any changes.
2. Copy the value of the LogoutURL key, then remove the following keys from the web.config:

   <add key="SingleLogout" value="True" />
   <add key="MultiSessionEnabled" value="True" />
   <add key="SingleSessionEnabled" value="False" />
   <add key="SSTokenName" value="SSToken" />
   <add key="MSTokenName" value="MSToken" />
   <add key="LogoutMethod" value="2" />
   <add key="CaptureLogoutURL" value="True" />
   <add key="LogoutUrl" value="https://URL" />
   <add key="LogoutTokenExpiration" value="True" />
   <add key="LogoutTokenExpirationTime" value="5" />
   <add key="SignLogoutMessage" value="False" />

3. If the realm is configured using Classic/Advanced Settings, migrate it to New Experience first.
4. Once the realm is on New Experience, open the application's settings and edit its Connection Settings.
5. Under the SAML Logout section, enter the SAML Logout URL (copied in step 2), the SAML Request Certificate, and the SAML Logout Binding, so the Single Logout option appears. Use the toggle switch to enable Single Logout, then click Update Settings.
6. If the service provider does not sign its SAML requests, enter a dummy value in the SAML Request Certificate field, enable Single Logout, then remove the dummy value and click Update Settings again.
7. Make sure the following key is set to True in the web.config:

   <add key="SingleLogoutEnabled" value="True" />

8. In the service provider's own settings, update its Identity Provider Single Logout URL to: https://example.idp.com/SecureAuthXX/SAML20LogoutService.aspx (substituting the realm's actual number for XX).
9. If updating that setting on the service provider isn't feasible, create an IIS URL Rewrite inbound rule on the IdP instead: match requests where the requested URL matches the pattern ^ManagedLogout.aspx (using regular expressions, case-insensitive), and rewrite them to SAML20LogoutService.aspx, with Append query string and Stop processing of subsequent rules both checked.

A successful Single Logout shows a confirmation page similar to the one below.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.