# \[keycloak\]SAML - Logout issue

**URL:** <https://forum.inductiveautomation.com/t/keycloak-saml-logout-issue/112422>\
**Category:** Ignition\
**Created:** [November 25, 2025, 2:43pm UTC](https://forum.inductiveautomation.com/t/keycloak-saml-logout-issue/112422 "2025-11-25T14:43:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![r.lebohec](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/r.lebohec/32/3704_2.png) [@r.lebohec](https://forum.inductiveautomation.com/u/r.lebohec)\
**Post date:** [November 25, 2025, 2:43pm UTC](https://forum.inductiveautomation.com/t/keycloak-saml-logout-issue/112422/1 "2025-11-25T14:43:00Z")

</div>

Hi,

While following the IdP configuration guide [Using Keycloak with Ignition | Inductive Automation](https://inductiveautomation.com/resources/article/using-keycloak-with-ignition) , I’ve noticed that my Idp SAML user _logout_ requests are not being executed properly.  
For troubleshooting, I’ve already enabled the **WebAuthSessionImpl** logger, but I’m wondering which additional Ignition logger would be useful to activate in order to get more detailed insight into the SAML flow, especially during Single Logout.

On the Keycloak side, the **“Logout Service Binding URL”** is configured as:

```python
https://<gateway>:8043/data/federate/callback/saml

```

If anyone has suggestions regarding other helpful loggers (SAML, IdentityProvider, Gateway…) or potential adjustments on the Keycloak/Ignition setup for SLO, I’d greatly appreciate it.

Thanks!

---

<div class="post-metadata">

**Author:** ![r.lebohec](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/r.lebohec/32/3704_2.png) [@r.lebohec](https://forum.inductiveautomation.com/u/r.lebohec)\
**Post date:** [November 27, 2025, 7:24am UTC](https://forum.inductiveautomation.com/t/keycloak-saml-logout-issue/112422/2 "2025-11-27T07:24:45Z")

</div>

Hi @jspecht,

It seems that this is undergoing a development. What is the status?

> [@\[FEATURE-12767,14002\] Perspective Logout and Redirect](https://forum.inductiveautomation.com/t/feature-12767-14002-perspective-logout-and-redirect/25265/7):
>
> Hi @Jonathan - We have a feature ticket on our backlog (12767) to implement the Single Logout (SLO) part of the SAML spec. Once that is delivered, you will be able to configure the SLO URL so that Ignition can notify the IdP when the user has logged out.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [December 1, 2025, 4:07pm UTC](https://forum.inductiveautomation.com/t/keycloak-saml-logout-issue/112422/3 "2025-12-01T16:07:39Z")

</div>

SAML Single Logout is still not supported as you found out. It’s still on the backlog. I’ll link this forum thread to the associated ticket which will hopefully bump its priority.