Skip to content

Commit 43454c9

Browse files
committed
edits
1 parent 08c7282 commit 43454c9

File tree

1 file changed

+22
-11
lines changed

1 file changed

+22
-11
lines changed

articles/spring-apps/how-to-configure-enterprise-spring-cloud-gateway.md

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -123,21 +123,32 @@ You can also view or edit those properties in the Azure portal, as shown in the
123123
> After configuring SSO, remember to set `ssoEnabled: true` for the Spring Cloud Gateway routes.
124124
125125
## Configure single sign-on (SSO) logout
126-
VMware Spring Cloud Gateway service instances provide a default API endpoint to logout of the current SSO session. The path to this endpoint is `/scg-logout`. There are two different outcomes that can be accomplished depending on how the logout endpoint is called: logout of session and redirect to IdP logout or only logout the service instance session.
127126

128-
### Logout of IdP and SSO Session
129-
Sending a GET request to the `/scg-logout` endpoint then it will send a 302 redirect response to the IdP logout URL. In order for user to be returned back to a path on the Gateway service instance, you can add a redirect parameter to the GET `/scg-logout` request. For example, `${serverUrl}/scg-logout?redirect=/home`.
130-
To implemente the function in your microservices, let's take a look at a concerete example.
131-
1. [A route config](https://github.com/Azure-Samples/animal-rescue/blob/0e343a27f44cc4a4bfbf699280476b0517854d7b/frontend/azure/api-route-config.json#L32) to route the logout request to your application is needed.
132-
2. In that application, you can do whatever logic you want to logout. At the end, you need to [send a get request](https://github.com/Azure-Samples/animal-rescue/blob/0e343a27f44cc4a4bfbf699280476b0517854d7b/frontend/src/App.js#L84) to the Gateway's `/scg-logout` endpoint.
127+
VMware Spring Cloud Gateway service instances provide a default API endpoint to log out of the current SSO session. The path to this endpoint is `/scg-logout`. You can accomplish one of the following two outcomes depending on how you call the logout endpoint:
128+
129+
- Logout of session and redirect to IdP logout.
130+
- Just logout the service instance session.
131+
132+
### Logout of IdP and SSO session
133+
134+
If you send a GET request to the `/scg-logout` endpoint, then the endpoint will send a 302 redirect response to the IdP logout URL. To get the endpoint to return the user back to a path on the gateway service instance, add a redirect parameter to the GET `/scg-logout` request. For example, `${serverUrl}/scg-logout?redirect=/home`.
135+
136+
The following steps describe an example of how to implement the function in your microservices.
137+
138+
1. You need [a route config](https://github.com/Azure-Samples/animal-rescue/blob/0e343a27f44cc4a4bfbf699280476b0517854d7b/frontend/azure/api-route-config.json#L32) to route the logout request to your application.
139+
140+
1. In that application, you can add whatever logout logic you need. At the end, you need to [send a get request](https://github.com/Azure-Samples/animal-rescue/blob/0e343a27f44cc4a4bfbf699280476b0517854d7b/frontend/src/App.js#L84) to the gateway's `/scg-logout` endpoint.
133141

134142
> [!NOTE]
135-
> The value of the redirect parameter is a valid path on the Gateway service instance. You cannot redirect to an external URL.
143+
> The value of the redirect parameter is a valid path on the gateway service instance. You can't redirect to an external URL.
136144
137-
### Only Logout SSO Session
138-
If the GET request to the `/scg-logout` is sent using a XMLHttpRequest (XHR), then the 302 redirect could be swallowed and not handled in the response handler. In this case, the user would only be logged out of the SSO session on the Gateway service instance and would still have a valid IdP session. The behavior typically seen in this case is that if the user attempts to login again they are automatically sent back to gateway as authenticated from IdP.
139-
A concerete example is as below. You still need to have a route config to route the logout request to your application but in the application, the below code will make gateway only logout sso session.
140-
```
145+
### Log out just the SSO session
146+
147+
If you send the GET request to the `/scg-logout` endpoint using a `XMLHttpRequest` (XHR), then the 302 redirect could be swallowed and not handled in the response handler. In this case, the user would only be logged out of the SSO session on the gateway service instance and would still have a valid IdP session. The behavior typically seen in this case is that if the user attempts to log in again, they are automatically sent back to the gateway as authenticated from IdP.
148+
149+
You need to have a route configuration to route the logout request to your application, as shown in the following example. This code will make a gateway-only logout SSO session.
150+
151+
```java
141152
const req = new XMLHttpRequest();
142153
req.open("GET", "/scg-logout);
143154
req.send();

0 commit comments

Comments
 (0)