SAML Logout Request not sent on POST Request /saml/logout with Spring Boot 3 and Angular

I'm migrating our Spring Boot Backend to Spring Boot 3 using org.opensaml and spring-security-saml-service-provider. Everything works as expected, but the logout is hard to get to work. (RP-Initiated)

If I understand correct, according to the documentation: https://docs.spring.io/spring-security/reference/servlet/saml2/logout.html a POST to the Endpoint, /saml/logout, automatically created by SAML with this Configuration, should create a SAML Logout Request and a SAML Logout Response as described in the SAML Protocol and clear the Session (In this example on Keycloak).

http.authorizeHttpRequests((authorize) -> authorize
.requestMatchers(SamlConfiguration.ERROR_AUTH_LANDING, SamlConfiguration.LOGOUT_AUTH_LANDING).permitAll()
.requestMatchers("/api/public/**", "/api/example/**", "/saml/**", "/logout/**", "/", "/api/user/**").permitAll().requestMatchers(FRONTEND_ROUTES).permitAll().requestMatchers(HttpMethod.OPTIONS).permitAll().requestMatchers(STATIC_RESOURCES).permitAll().requestMatchers(SWAGGER_RESOURCES).permitAll().anyRequest().authenticated())
.saml2Login(saml2 -> saml2.relyingPartyRegistrationRepository(relyingPartyRegistrationRepository)
.loginPage("/saml/login").successHandler(successRedirectHandler)
.failureHandler(samlAuthenticationFailureHandler))
.saml2Logout(Customizer.withDefaults());


Instead of doing all that, Spring Boot reacts with a Response which consists of a Form, which then would send the SAML Request. However I'm not able to make any use of that response. Does anybody know how to process this in the Angular Frontend?

public logout(): Observable<void> {
const endpoint = `${Endpoint.appBaseUrl}/saml/logout`;
return this.http.get(endpoint, { responseType: 'text' }).pipe(
map(() => {
this.removeToken();
})
);
}


I tried to create a CustomSaml2LogoutSuccessHandler which implements a LogoutSuccessHandler which does the SAML Logout Request and Response. However this leads to a CORS Error. So i don't think it's the correct way. I also tried to set the Logout Service Url via

.singleLogoutServiceResponseLocation("{baseUrl}/saml/logout")


However neither of those ideas lead to the desired outcome of starting a SAML Logout Request/Response process.

Does anyone have a solution for this scenario?

Continue reading...