Loading
Prepare for Email to Become the Default Login ExperienceRead More
Secure Your Salesforce Org
SAML Session Index Support

You are here:

  1. Salesforce Help
  2. Docs
  3. Secure Your Salesforce Org

SAML Session Index Support

Salesforce supports session index parameters in requests and responses with SAML single logout (SLO). When a user logs out of a connected app registered for SAML SLO, the session index parameter is required to identify which user session to end.

Required Editions

Available in: both Salesforce Classic and Lightning Experience
User Permissions Needed
To view the settings: View Setup and Configuration
To edit the settings:

Customize Application

AND

Modify All Data

As the identity provider, Salesforce generates and sends the session index parameter to the service provider during SAML single sign-on (SSO). Depending on the application initiating SLO, one of these processes occurs.

  • If Salesforce initiates SLO, Salesforce sends the same session index parameter with the logout request to the service provider.
  • If the service provider initiates SLO, Salesforce sends the SAML SLO request to the other service providers participating in the current session. The other service providers post a logout response to Salesforce. Salesforce then returns the logout response to the initiating service provider.

As the service provider, Salesforce receives and stores the session index parameter sent from the identity provider during SSO. If the identity provider initiates SLO, Salesforce sends a logout response. If Salesforce initiates the SLO, it sends the same session index parameter with the logout request to the identity provider.

Note
Note If the identity provider sends more than one session index parameter, Salesforce stores only the first one that it receives. The session index parameter can’t be more than 512 characters.
 
Loading
Salesforce Help | Article