Invalidating session doesn't work

[prajith-nair]

We have configured Google SAML to perform SSO for our app. Enabled MellonEnabledInvalidateSessionEndpoint On in httpd.conf

<Location />
          #All the below variables are important for Mellon to function as expected.
          MellonSamlResponseDump On
          # Mellon Config for Google SAML App
          MellonVariable "cookie"
          #If this functionality is enabled, invalidate the session by calling the endpoint "/invalidate?ReturnTo=".
          MellonEnabledInvalidateSessionEndpoint On
          MellonSecureCookie on
          # session cookie duration; 43200(secs) = 12 hours
          MellonSessionLength 43200
          MellonUser "NAME_ID"
          MellonSetEnv "e-mail" "mail"
          MellonSPPrivateKeyFile /usr/local/apache2/mod_auth_mellon/google_metadata/mellon.key
          MellonSPCertFile /usr/local/apache2/mod_auth_mellon/google_metadata/mellon.crt
          MellonSPMetadataFile /usr/local/apache2/mod_auth_mellon/google_metadata/mellon_metadata.xml
          MellonIdPMetadataFile /usr/local/apache2/mod_auth_mellon/google_metadata/GoogleIDPMetadata.xml
          # Mellon Config for Customer's Okta SAML App
          MellonIdPMetadataFile /usr/local/apache2/mod_auth_mellon/okta_metadata/idp_metadata.xml
          MellonDiscoveryUrl "https://${HOST_NAME}:${PROXY_EXPOSED_PORT}/idp-discovery.html"
          MellonEndpointPath /mellon
          MellonDefaultLoginPath /
          RequestHeader set X-WEBAUTH-USER "%{MELLON_NAME_ID}e"
</Location>

Redirect "/logout" "/mellon/invalidate?ReturnTo=https://${HOST_NAME}:${PROXY_EXPOSED_PORT}/"

The flow works as expected, when user clicks on "Logout" from UI, user is redirected to

https://my.domain.com:10020/idp-discovery.html?ReturnTo=https://my.domain.com:10020/

However, when user clicks on "Login" from above location, they are authenticate and allowed to login.

mellon-cookie seems to be activate as its not affected by /mellon/invalidate

Any thoughts?

[thijskh]

Are you sure you're not just seeing Single Sign On behaviour from the IdP? That is, the mellon session is indeed invalidate, you are redirected to the IdP again but this IdP has Single Sign On so you're immediately redirected back to the SP and get a new session? You can confirm this with the SAML Tracer browser plugin.