SAML2 Logout

[j3cky]

Hi,
i have configure cloudstack sso using keycloak and i have success login with sso. but when i want to logout, logout success from cloudstack but the session still exist in keycloak. how can i logout from both cloudstack and keycloak?

[DaanHoogland]

@j3cky , what version are you experiencing this in?

[j3cky]

@j3cky , what version are you experiencing this in?

i am experiencing this issue in version 4.22
and i have another env using 4.20.1 but got different logout issue, in this env i will updated to version 4.20.2 and see if it is fixed.

[DaanHoogland]

you are saying that #11361 is not the solution as @weizhouapache suggests. this is not in 4.20.1 but should be in 4.22.

[weizhouapache]

there was a SAML issue fixed in 4.20.2.0
#11630
#11745
#11078

fix: #11361

[bradh352]

I can confirm the logout loop issue is fixed in 4.22.0. I use Okta, I haven't looked to see if the session there is notified of the termination, I didn't think OIDC notified on logout (but honestly haven't looked into it)

[j3cky]

HI logout loop issue resolved in 4.20.2. but my issue is after i logout from from cloudstack then i can login again without use password.. i use microsoft entarid with cloudstack. how can i logout from both cloudstack and entraid?

[RosiKyu]

@DaanHoogland, @weizhouapache, @j3cky, I performed some testing on this.

#11361 fixes the logout loop / cookie cleanup issues (#11078, #11630) - but does not implement SAML Single Logout (SLO) to terminate IdP sessions. This is not a regression - I don't think that SLO has been implemented.

@j3cky: After CloudStack logout, you can login again without password because the IdP session (Microsoft Entra ID / Keycloak) is still active.

I have tested with:

• CloudStack 4.22.0.0
• Keycloak 26.0.6

SAML Login - Works

2025-11-26 07:41:06,928 DEBUG [c.c.a.ApiServlet] ===START=== 10.0.3.251 -- GET command=samlSso&idpid=http://10.0.33.46:8180/realms/cloudstack-saml
2025-11-26 07:41:06,977 DEBUG [o.a.c.a.c.SAML2LoginAPIAuthenticatorCmd] Sending SAMLRequest id=ia8p1tggsoa2o8c5e0vpk6g38g2vlggd
2025-11-26 07:41:14,207 DEBUG [o.a.c.a.c.SAML2LoginAPIAuthenticatorCmd] Received SAMLResponse in response to id=ia8p1tggsoa2o8c5e0vpk6g38g2vlggd
2025-11-26 07:41:14,214 DEBUG [o.a.c.s.SAMLUtils] SAML attribute name: username friendly-name:null value:admin
2025-11-26 07:41:14,220 DEBUG [o.a.c.s.SAML2UserAuthenticator] Trying SAML2 auth for user: admin

CloudStack Logout - Works (PR #11361 fix)

• Cookies cleared properly
• No API flooding
• Clean logout to login page

IdP Session Termination - not supported / not working

Browser Network tab on logout shows:

• api/?command=logout&sessionkey=... (200 OK)

• api/?command=listIdps (200 OK)

• api/?command=listOauthProvider (200 OK)

• api/?command=forgotPassword (401 - expected)

• No samlSlo request. No redirect to IdP.

• Keycloak Sessions page: User session still active after CloudStack logout.

• Keycloak logs: No LOGOUT events received - CloudStack never sent a SAML LogoutRequest.

Result: Clicking "Login with SAML" again logs in automatically without password prompt (except on initial login)

Screencast.from.2025-11-26.11-14-36.webm

[DaanHoogland]

thanks @rosi-shapeblue , @j3cky it seems you want an added feature. I am not sure what it would be, but the obvious implementation from a functional view would be a hook into entra that would invalidate the current logon. question is if we would then remove access to other applications as well. We could make it optional depending on a setting at some level. in any case some kind of "send a SAML LogoutRequest” could be implemented.

[j3cky]

hi @DaanHoogland , any plan to add SLO feature?

[DaanHoogland]

Not that I know off, @j3cky. I am also not familiar enough with the concept to make an estimate of effort, but it seems a simple hook somewhere.