Salesforce作为IdP时Cognito SAML2单点登出异常及会话残留问题咨询

Chrome Version 119.0.6045.159 (Official Build)
Salesforce 58.x
AWS Cognito User Pools
AWS Amplify [ui-components] 1.9.40

我方应用作为连接应用安装在Salesforce组织中，用户登录Salesforce后，Salesforce作为身份提供商（IdP），允许我方应用登录自身服务。简言之，Salesforce为IdP，我方为服务提供商，应用依赖AWS Cognito进行身份管理。

我们采用SAML2工作流实现单点登录（SSO）与单点登出（SLO），单点登出URL如下：

https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com/saml2/logout

该URL采用POST绑定。

当用户从Salesforce登出时，上述URL会收到含SAML2登出请求的POST请求，但响应为302重定向至：

https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com/error?null

我们通过curl验证端点存在：

$ curl -iv -X GET https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com/saml2/logout
...
* Connected to xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com (35.83.156.62) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=*.auth.us-west-2.amazoncognito.com
*  start date: Jan 28 00:00:00 2023 GMT
*  expire date: Feb 26 23:59:59 2024 GMT
*  subjectAltName: host "xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com" matched cert's "*.auth.us-west-2.amazoncognito.com"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M01
*  SSL certificate verify ok.
* using HTTP/2
* h2 [:method: GET]
* h2 [:scheme: https]
* h2 [:authority: xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com]
* h2 [:path: /saml2/logout]
* h2 [user-agent: curl/8.1.2]
* h2 [accept: */*]
* Using Stream ID: 1 (easy handle 0x125810c00)
> GET /saml2/logout HTTP/2
> Host: xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com
> User-Agent: curl/8.1.2
> Accept: */*
> 
< HTTP/2 400 
HTTP/2 400 
< date: Sun, 03 Dec 2023 18:41:35 GMT
date: Sun, 03 Dec 2023 18:41:35 GMT
< content-type: text/html;charset=UTF-8
content-type: text/html;charset=UTF-8
< content-security-policy-report-only: script-src https://dpp0gtxikpq3y.cloudfront.net https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com; style-src https://dpp0gtxikpq3y.cloudfront.net https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com; img-src https://dpp0gtxikpq3y.cloudfront.net https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com; report-uri https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com/cspreport
content-security-policy-report-only: script-src https://dpp0gtxikpq3y.cloudfront.net https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com; style-src https://dpp0gtxikpq3y.cloudfront.net https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com; img-src https://dpp0gtxikpq3y.cloudfront.net https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com; report-uri https://xxxxxxx-yyyyyyyyy-dev.auth.us-west-2.amazoncognito.com/cspreport
< set-cookie: XSRF-TOKEN=3665ddc9-d7ca-4f1d-9ca3-ecc7015f92fd; Path=/; Secure; HttpOnly; SameSite=Lax
set-cookie: XSRF-TOKEN=3665ddc9-d7ca-4f1d-9ca3-ecc7015f92fd; Path=/; Secure; HttpOnly; SameSite=Lax
< x-amz-cognito-request-id: 0009fc90-6529-4ea3-bda5-6bf77b96084a
x-amz-cognito-request-id: 0009fc90-6529-4ea3-bda5-6bf77b96084a
< allow: POST
allow: POST
...

从响应的allow字段可知，该端点要求使用POST方法。

1. 登出跳转至/error且无详情的错误含义 #

这个无详情的/error?null是Cognito对SAML登出请求验证失败的通用反馈，常见原因包括：

• SAML登出请求中的NameID或SessionIndex与Cognito存储的用户会话不匹配；
• Salesforce发送的SAML请求签名无效，或Cognito未正确配置Salesforce的签名证书；
• 请求缺少必要的SAML参数（如SAMLRequest），或参数格式不符合SAML 2.0规范；
• Cognito用户池中SAML身份提供商的登出配置错误，比如未正确设置IdP的登出URL或响应绑定方式。

开启Cognito的CloudWatch日志，查看用户池的登录/登出日志，可获取具体错误代码与原因。

2. /saml2/logout正常工作的预期行为 #

当/saml2/logout正常处理SAML登出请求时，预期行为如下：

• Cognito侧：立即吊销用户对应的access token、refresh token和ID token，无效化用户在Cognito中的会话；
• 重定向逻辑：处理完成后，会根据配置重定向到指定的登出回调URL（需在Cognito用户池的SAML身份提供商设置中配置Logout URL）；
• IdP会话：Cognito不会主动清除Salesforce的IdP会话，全局登出依赖SAML双向交互——若Salesforce发送LogoutRequest，Cognito处理后会发送LogoutResponse给Salesforce，由Salesforce完成自身会话清除；若Salesforce触发全局登出，通常先清除自身会话，再通知所有关联服务提供商（包括Cognito）清除会话。

简言之，正常工作时，Cognito会彻底清除自身管理的令牌与会话，同时配合IdP完成全局登出流程，而非仅清除本地存储的令牌。

内容的提问来源于stack exchange，提问作者Kode Charlie