I’ve been using the library using a custom resolver for the sessions from the database. All is working fine until I need to ensure that SLO is working (so far it wasn’t). Tried several approaches, the best result so far was given by the following setup
// https://docs.microsoft.com/en-us/azure/azure-monitor/app/asp-net-core
builder.Services.AddApplicationInsightsTelemetry();
builder.Services.Configure<CookiePolicyOptions>(options =>
{
// SameSiteMode.None is required to support SAML SSO.
options.MinimumSameSitePolicy = SameSiteMode.None;
});
builder.Services.ConfigureApplicationCookie(options =>
{
// Use a unique identity cookie name rather than sharing the cookie across applications in the domain.
options.Cookie.Name = "DatabaseServiceProvider.Identity";
// SameSiteMode.None is required to support SAML logout.
options.Cookie.SameSite = SameSiteMode.None;
});
builder.Services.AddDistributedSqlServerCache(options =>
{
options.ConnectionString = builder.Configuration["ConnectionStrings:Db"];
options.SchemaName = "Integrations";
options.TableName = "SamlCache";
options.ExpiredItemsDeletionInterval = TimeSpan.FromDays(30);
});
builder.Services.AddSaml();
builder.Services.Configure<SamlConfigOptions>(builder.Configuration.GetSection("Saml"));
builder.Services.AddScoped<SamlConfigService>();
builder.Services.AddTransient<ISamlConfigurationResolver, CustomConfigurationResolver>();
builder.Services.AddDbContext<IdentityDbContext>(options =>
options.UseSqlServer(builder.Configuration["ConnectionStrings:Db"]));
builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();
builder.Services.AddSession(options =>
{
options.Cookie.Name = "saml-session";
options.IdleTimeout = TimeSpan.FromSeconds(100);
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
options.Cookie.IsEssential = true;
});
The session is correctly generated:
The issue however is that upon logout I get
SSO Session not found, cannot execute Single Logout. Exception: There is no SSO session to partner XXXX to logout.
while I can see that the partner is in the value of the second cache I shared.
Now, I’ve seen some other posts (like Distributed Cache Session using Redis - #2 by ComponentSpace) mentioning the order of items does change the outcome, so I’m wondering if that can be the case here? Putting the distributed cache initialisation after AddSaml() as recommended causes the partner configuration to not be found even during SSO. I also noticed (through a custom implementation of ISsoSessionStore) that the session changes more often than I would expect, so that might also be the reason? However the setup being tested is quite conservative:
builder.Services.AddSession(options =>
{
options.Cookie.Name = "saml-session";
options.IdleTimeout = TimeSpan.FromSeconds(100);
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
options.Cookie.IsEssential = true;
});
Running on version 4.3