Saml logout - Use the SingleLogout

[sso_sad]

Hello

I'm trying to configure Plateforme SAP BusinessObjects BI 4.3 SP2 Patch 5 with Keycloak using SAML2.
I'm on Red Hat Enterprise Linux release 8.4.

I've followed this great note :
https://launchpad.support.sap.com/#/notes/2791348

And I can logon to BOE Apps using SAML, but the note don't explain how to configure BO to do a global logout.
Right now when a logout from BOE/BI, I land on the authentication page of Fiori, then if I re-use the URL https://.../BOE/BI , I am automatically login...

I assume the logout kill the 'BO SSO token' but not the 'global SAML token'.
(sorry if I use the wrong terms)

Any idea how to have a logout button who leads to a global logout ?I sense that it's related to a configuration of a singleLogout thing in the securityContext.xml of BOE.
But it's not clear to me.

Thanks and regards.

[former_member824863 · Accepted solution]

Hi Le Verge Nicolas,

SLO is used to close the IdP application session when the user exits the (SP) application. BI Platform is not fully SAML compliant, meaning that it does not support SLO at this time. It does support Single Sign On (SSO).

The only true workaround is to modify the 'url.exit' property which can direct all users to a specific URL when they click the logout button.
You can read about this more in this KBA below:

https://launchpad.support.sap.com/#/notes/1695974