Hello all, I am configuring saml (with ping federate) on one of our netscalers. I've configured redirect and logout URLs correctly on netscalers saml server. I login, authenticates at ping federate, redirect to storefront, see the apps. All good. When I click logoff, it goes to https://netscalergatewayURL/citrix/samlWeb URL. It says Logoff is successful with a logon button. But it should redirect to https://netscalergatewayURL/cgi/logout or /vpn/logout. But it just stops there at storefront logout url. Can someone help me with this issue?

there's a singlelogout URL that is configured in your IdP, in this case Ping. Did you do a Netscaler SP XML import, or did you configure manually in Ping? if you did an XML, the header should be SingleLogoutService Binding. I'm not familiar with Ping's UI, so I'm trying to find screenshots of what their config looks like if you did it manually.

I have manually created redirect and single logout urls.

In browser network trace, does it hit the logout URL in the IdP side (Ping)? Shouldn't you end up in the Ping logout page rather than the NetScaler logout page? I think I did a responder redirect in some environment as a dirty quick workaround where I redirected the logout request to /cgi/logout, but in this case the IdP session might not logout and the user could still get back in just by typing the Gateway URL again.

I've added a responder policy on ADC but it points to http.xx.xxx.xxx('/cgi/logout') || http.xx.xxx.xxx('/vpn/logout'). As mentioned earlier, I dont see /cgi/logout or /vpn/logout in the URL when I click logout.

Run the browser devel tools and the network trace (persist logs knob selected) and then click the logout button and you should see what URLs the browser session hits? Or have you done so already?

Ah, I misunderstood the question. Are you referring to the Logoff button in Storefront? What version of Storefront?

7.15 CU6

It may be the verison, let me see if I can find the KB