Logout of SAML completely

POST /_security/saml/complete_logout

Auth

Verifies the logout response sent from the SAML IdP.

Note

This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The SAML IdP may send a logout response back to the SP after handling the SP-initiated SAML Single Logout. This API verifies the response by ensuring the content is relevant and validating its signature. An empty response is returned if the verification process is successful. The response can be sent by the IdP with either the HTTP-Redirect or the HTTP-Post binding. The caller of this API must prepare the request accordingly so that this API can handle either of them.

More about SAML authentication

Request body

realm string required: The name of the SAML realm in Elasticsearch for which the configuration is used to verify the logout response.
ids union oneOf required: A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user.; One of: string[] or string
query_string string: If the SAML IdP sends the logout response with the HTTP-Redirect binding, this field must be set to the query string of the redirect URI.
content string: If the SAML IdP sends the logout response with the HTTP-Post binding, this field must be set to the value of the SAMLResponse form parameter from the logout response.

Response

200 application/json

Examples

Request Console 1 / 8 languages

Run POST /_security/saml/complete_logout to verify the logout response sent by the SAML IdP using the HTTP-Redirect binding.

Console Kibana Dev Tools

POST /_security/saml/complete_logout
{
  "realm": "saml1",
  "ids": [ "_1c368075e0b3..." ],
  "query_string": "SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK..."
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.samlCompleteLogout({
  realm: "saml1",
  ids: ["_1c368075e0b3..."],
  query_string:
    "SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK...",
});

Python Elasticsearch Python Client

resp = client.security.saml_complete_logout(
    realm="saml1",
    ids=[
        "_1c368075e0b3..."
    ],
    query_string="SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK...",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/saml/complete_logout" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "realm": "saml1",
    "ids": [
      "_1c368075e0b3..."
    ],
    "query_string": "SAMLResponse=fZHLasMwEEVbfb1bf...\u0026SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1\u0026Signature=CuCmFn%2BLqnaZGZJqK..."
  }'

Java Elasticsearch Java Client

client.security().samlCompleteLogout(s -> s
    .ids("_1c368075e0b3...")
    .queryString("SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK...")
    .realm("saml1")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .SamlCompleteLogoutAsync(d1 => d1
        .Ids(new[] { "_1c368075e0b3..." })
        .QueryString("SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK...")
        .Realm("saml1")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->samlCompleteLogout([
    "body" => [
        "realm" => "saml1",
        "ids" => array(
            "_1c368075e0b3...",
        ),
        "query_string" => "SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK...",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.saml_complete_logout(
  body: {
    "realm": "saml1",
    "ids": [
      "_1c368075e0b3..."
    ],
    "query_string": "SAMLResponse=fZHLasMwEEVbfb1bf...&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=CuCmFn%2BLqnaZGZJqK..."
  }
)

Response

No example

Request Console 1 / 8 languages

Run POST /_security/saml/complete_logout to verify the logout response sent by the SAML IdP using the HTTP-Post binding.

Console Kibana Dev Tools

POST /_security/saml/complete_logout
{
  "realm": "saml1",
  "ids": [ "_1c368075e0b3..." ],
  "content": "PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46..."
}

JavaScript Elasticsearch JavaScript Client

const response = await client.security.samlCompleteLogout({
  realm: "saml1",
  ids: ["_1c368075e0b3..."],
  content: "PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46...",
});

Python Elasticsearch Python Client

resp = client.security.saml_complete_logout(
    realm="saml1",
    ids=[
        "_1c368075e0b3..."
    ],
    content="PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46...",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/saml/complete_logout" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "realm": "saml1",
    "ids": [
      "_1c368075e0b3..."
    ],
    "content": "PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46..."
  }'

Java Elasticsearch Java Client

client.security().samlCompleteLogout(s -> s
    .content("PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46...")
    .ids("_1c368075e0b3...")
    .realm("saml1")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .SamlCompleteLogoutAsync(d1 => d1
        .Content("PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46...")
        .Ids(new[] { "_1c368075e0b3..." })
        .Realm("saml1")
    );

PHP Elasticsearch PHP Client

$resp = $client->security()->samlCompleteLogout([
    "body" => [
        "realm" => "saml1",
        "ids" => array(
            "_1c368075e0b3...",
        ),
        "content" => "PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46...",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.security.saml_complete_logout(
  body: {
    "realm": "saml1",
    "ids": [
      "_1c368075e0b3..."
    ],
    "content": "PHNhbWxwOkxvZ291dFJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46..."
  }
)

Response

No example