I’m putting together a gem for our Rails apps to use SAML single sign-on/logout via Entra ID. I had some questions about the final bit I need to implement: ID provider initiated single logout requests.

We’re using Active Record Session Store in the service providers (Rails apps), by default the table that creates stores the session ID and the session data. There’s no way for the IdP to know that session ID for each SP though, right? The only information I have to go by is the name ID (username associated with the session) in the IdP logout request? Effectively I need to store the name ID in the session table as well, find the appropriate session by the name ID on the IdP logout request, and delete that session?

The problem I’m running in to right now is that the session is not being deleted when the IdP logout request comes in. I think is because the Active Record Session Store middleware isn’t grabbing the correct session for that request. Instead a new session is being added in the table.

Tangentially related, is SLO possible with a cookie store?