Azure AD SSO - Log Out Page, Automatically Signing In

Question

Guys,

I have implemeted SSO with Azure AD with my test instance. I am using 2019.2. Works fine - MFA triggers etc.

But when I log out from Adaxes websites, it redirects me to "/Adaxes/WebApp_Name#/SamlSignOut" page. And there is a big blue sign in button, if user clicks again it - pages logs him back to the application without any Azure AD MFA challenge etc. Is it just happening with me or somebody else?

I believe SAML sign out method is not implemented here - https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol

We have 100s of apps - like workday, service now - when you sign out , they kind of kill the access token and re-ask for authentication. This is a secured way of doing because it kills the access token and protects from back button and if user forgets to close browser etc.

If this is an application design issue, I would like to know ETA for the fix. It is going to attract some nasty looks from Infosec guys - specially when it is a user management tool.

Answer 1

Hello Brajesh,

And there is a big blue sign in button, if user clicks again it - pages logs him back to the application without any Azure AD MFA challenge etc. Is it just happening with me or somebody else?

When a user initiates log out from a Web Interface, their token in Azure AD IdP stays valid. It allows them to use other services registered in the IdP.

I believe SAML sign out method is not implemented here

The method is not implemented with Adaxes because it logs out users from all the services registered in the IdP. It is done for the convenience of the users which use multiple services accessed via the IdP.

Comments

But it is a security vulnerability.

Doesn't matter if it logs out all other concurrent sessions in the same browser. Adaxes is a powerfull identity management application. This should be implemented keeping the security at mind not just convenience. May be have two sign-out options in the drop down. I am sure everybody will agree with that.

What is the solution here? Is there a way I can at least I can redirect the logout to a different URL and remove that big sig in button?

---

Unfortunately, there is no possibility to redirect logout to a different URL or remove the Sign In button.