Issue with SSO Logout When Multiple Applications Are Open (AspNetSaml 2.1.2 + ForgeRock)

[suhasbhole77]

We have an ASP.NET Web Forms application targeting .NET Framework 4.8, and we are using the AspNetSaml 2.1.2 NuGet package to implement SSO across four applications.

SSO Details

• SAML: SP‑initiated
• Identity Provider (IdP): ForgeRock
• All applications share the same IdP session

Current Behavior

• Login works perfectly for all applications.
• If we open a new browser window and login to only one application, then perform a logout, it works as expected
• If multiple applications are opened in the same browser window in different tabs and share the same IdP session:
  • Login works correctly for all applications.
  • Logout does not work properly.
  • After clicking logout, the user is redirected back to the last opened application instead of being fully logged out.

Expected Behavior
User should be logged out from the IdP and all applications when logout is initiated from any one application.

Question
Has anyone faced a similar issue with AspNetSaml 2.1.2 and ForgeRock, especially in a multi‑application SSO scenario?
Any guidance on configuring SAML Single Logout (SLO) or handling IdP sessions correctly would be greatly appreciated.

Thanks in advance for your help.

[alex-jitbit]

Please define "opened". As in "one application is opened "

Opened in multiple tabs? Multiple computers? Runs on multiple servers???!?!

[suhasbhole77]

Hello @alex-jitbit,

Thanks for your comments.

In our context, “opened” means that a single application is logged in within one separate browser tab. In this scenario, both login and logout work correctly.
However, when multiple applications are opened in multiple tabs within the same browser—all sharing the same IdP session—login works fine, but the issue occurs during logout. When we try to log out, the browser gets redirected to the last application that was opened.

[alex-jitbit]

IdP-initiated logouts are handled by IdP we do not control where they redirect you to

[suhasbhole77]

Hello @alex-jitbit,

This is an SP‑initiated logout, not an IdP‑initiated one. In this case, the user clicks the logout button in my front‑end application, which then sends a logout request to the IdP.

[alex-jitbit]

This means your IdP does not send IdP-initiated logout requests when it received IdP initiated logout. This is either a setting that needs to be configured, or they haven't implemented it