SSO Single Logout (SLO) Failure with WSO2 - Identity Manager

Products

• CA Identity Suite
• CA Identity Manager
• SITEMINDER

Issue/Introduction

When integrating Identity Manager with WSO2 for Single Sign-On (SSO) using OpenID Connect, Single Logout (SLO) may fail to trigger correctly. Users are redirected to the native Identity Manager logout screen instead of the configured WSO2 end session endpoint, preventing the WSO2 session from being terminated.

Environment

Identity Manager 14.5 & 15

Cause

The WSO2 Single Logout process is bypassed because the MainConsoleLogoutUrl property is not configured in the environment settings. Consequently, Identity Manager utilizes its native logout handler, ignoring the configured authentication module end session endpoint.

Resolution

1. Log in to the Identity Manager Management Console.
2. Navigate to Environments.
3. Select the applicable environment.
4. Go to Advanced Settings > Miscellaneous.
5. Locate the MainConsoleLogoutUrl property.
6. Set the value to point to the appropriate logout URL required for the WSO2 integration.
7. Save the configuration and restart the Identity Manager application server.

Additional Information

For further information about Siteminder integration, see documentation:

Information about MainConsoleLogonUrl, see Miscellaneous Properties - 14.5 or Miscellaneous Properties - v15

Logoff URL Configure the LogOff URI - 14.5 or Configure the LogOff URI - v15

If you have any issue with MainConsoleLogoutUrl doesn't work

How to update Logout url in identityEnv, see How to update Logout url (MainConsoleLogoutUrl) in CA identityEnv

 

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.