Configure SAML Logout for Cortex XSOAR. Create a SAML integration with a public/private key pair.
The SAML provider is a user authentication third-party provider that helps to manage users. When you log in, the provider checks if you are a valid user. If you are authenticated, the provider assigns a session ID to you which is valid for a period of time. The next time you log in, you do not need a password, because the session is still valid from the previous login, even if you logged out of Cortex XSOAR. If you log out via SAML, the provider invalidates the session and the next time you log in to the system you need to enter a password.
To set up SAML logout, you need to create a SAML integration with a public/private key pair. You can:
Use a self signed certificate.
Purchase a certificate from a third-party authority.
(Optional) To use a self signed certificate:
Create the public/private key pair by running the following command:
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt
The following two files are created:
certificate.crt - Public key
privateKey.key - Private key (encrypted)
For the Cortex XSOAR SAML integration, the private key needs to be unencrypted. Run the following command:
openssl rsa -in privateKey.key -out private_unencrypted.key -outform PEM
The following file is created: private_unencrypted.key - Private key (unencrypted)
Go to
→ → .Search for SAML 2.0.
Click Add instance to configure a new integration.
In the Service Provider Entity ID field, enter the Cortex XSOAR SAML address.
Click the Sign request and verify response signature option.
From your identity provider, copy the content of the public certificate file and paste it into the IdP public certificate field of the Cortex XSOAR SAML instance.
Copy the content of your private_unencrypted.key file and paste it into the IdP private key field.
In your identity provider application:
Select the Enable Single Logout option (if applicable).
In the Signature certificate field, upload the certificate.crt file.
Copy the IdP Single Logout URL.
In the IdP Single Logout URL field of the SAML instance, paste the IdP Single Logout URL that you copied in the previous step.
In the Single Logout Service Endpoint field, type the Cortex XSOAR SAML logout address.
https://<
xsoarServer
>.com<port
>/saml-logoutClick Done.