Spring SAML SSO do not share session

Question

I have configured WSO2 Identity Server as IDP and have two applications configured as SP. All working fine, except few things:

• when I logged out from one application, another application don't see, that I was logged out

• when I login into one application, another application don't see, that I was logged in

IMHO, there is main principles of SSO and SLO.

When I check SecurityContextHolder.getContext().getAuthentication() there is no changes after logout or login in another app.

Maybe I should call WSO2 page /samlsso before every load url?

What can I do wrong? How to retrieve from another app, that user logged out/logged in?

EDIT:

For example, WSO2 API Manager Store have such mechanism:

• when I logged out from my application and reload Store page, then going redirection to main not logged page in Store. Same with login.

UPDATE:

I found problem in class org.springframework.security.saml.websso.SingleLogoutProfileImpl. When logout request is coming from WSO2 IS, than objects Authentication and SAMLCredential are nulls and error No user is logged in is occured, but for real user still logged in in Spring SAML application.

Same discussion was here, but with no effect :\

Answer 1

You have to verify whether both apps are calling Identity Server (IS) using the same host name. E.g. https://is.blahblah.com/samlsso.

IS session is based on cookies ('commonAuthId' and 'samlssoTokenId' cookies to be specific). If apps are calling IS using two different host names, there will be two different sessions created at the IS side. For SSO and SLO to happen both apps must share a single IS session.

Answer 2

We are using travelocity.com and avis.com web app for test SAML2 sso. You can found the more details here[1]. Further you can checked this documentation[2] Registering the two service providers in the Identity Server and followed the 1 to 8 steps.

[1] https://docs.wso2.com/display/IS500/Configuring+Single+Sign-On+with+SAML+2.0

[2] https://docs.wso2.com/display/IS500/Customizing+Login+Pages