APM: how configure logout user session

Hi Massimo,

correct me if I'm wrong, but I searched on the whole thread and I didn't find any information about SAML on initial question and following comments.

The answer provided from Kai may not work because of this missing but required information.

So now, Can you provide any informations required to help you troubleshoot.

• Where is the IdP? on the BigIP?
• Where are SP? on the BigIP?

when you ask to logout with SLO enabled, the process is the following:

1. user request an access to Service1 --> redirect to IdP for authentication with assertion
2. user authenticate on IdP --> redirect to SP Service1 with assertion
3. user request an access to Service2 --> redirect to IdP for authentication with assertion
4. user is already authenticated on IdP --> redirect to SP Service1 with assertion
5. user request a logout on Service2 --> redirect to IdP for logout
6. user request a logout on IdP --> redirect to Service1 for logout
7. user request a logout on Service1 --> redirect to IdP to confirm Logout
8. user request a logout on IdP --> redirect to Service2 to confirm Logout of all SP which used same session
9. user request a logout on Service2 --> The session on Service2 is closed only when this request is received on APM

If One SLO request fails, the session is not closed on Service2