Logout Request

SAML Logout Request Examples

The SAML LogoutRequest is sent to initiate a Single Logout (SLO) flow, either from the SP or the IdP. This terminates the user’s session across all participating service providers.

Example LogoutRequest

<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                     ID="_cbb63e9741b554fc40e94ae3693b0aca81bc0e0c"
                     Version="2.0"
                     IssueInstant="2014-07-18T01:13:06Z"
                     Destination="https://idp.example.com/SingleLogoutService.php">
    <saml:Issuer>https://sp.example.com/demo1/metadata.php</saml:Issuer>
    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
        user@example.com
    </saml:NameID>
    <samlp:SessionIndex>_be9967abd904ddcae3c0eb4189adbe3f71e327cf93</samlp:SessionIndex>
</samlp:LogoutRequest>

Key Elements

Element	Description
ID	A unique identifier for the logout request
Destination	The SLO endpoint of the IdP or SP
Issuer	The entity initiating the logout
NameID	Identifies the user whose session is being terminated
SessionIndex	References the specific session to terminate

SLO Flow

User initiates logout at one SP
SP sends LogoutRequest to the IdP
IdP sends LogoutRequest to all other SPs with active sessions
Each SP terminates the local session and responds
IdP sends final LogoutResponse back to the initiating SP

For interactive SAML logout tools, visit SAMLTool.com.