3772827 - Error Identity Provider could not process the logout message received in the logout for SuccessFactors using IAS/Corporate IdP

• When logging out, the browser displays the message HTTP 401 Identity Provider could not process the logout message received
• When checking IAS logs, see the error Identity Provider could not process the logout message received from an attempt to log out.
• I am getting the concurrent session warning in IAS, although I have logged out from SuccessFactors.

SAP SuccessFactors HCM Suite

1. Log in to SuccessFactors integrated to IAS
2. Log out from SuccessFactors; logout page confirms success.
3. Attempt to log in again immediately.
4. Observe IAS error that an active session exists and login is blocked.

OR

1. Log in to SuccessFactors integrated to IAS
2. Log out from SuccessFactors; logout page displays the error HTTP 401 Identity Provider could not process the logout message received.

The error is caused by the fact that the Identity Provider - in this case, IAS - cannot process the log out request due to the domain mismatch. 

First, ensure the logout URLs are properly set up from IAS and SuccessFactors side:

• In SuccessFactors > Go to Manage SAML SSO Settings > Edit in the pencil icon the current Corporate IDP > add a Redirect URL when log out. 
• In IAS > if you have a corporate IdP (such as Azure, Entra ID, Okta, etc) > Go to Identity Providers > select your current IdP > edit the option Logout Redirect URL. 

NOTE: If you have a corporate IdP, the logout URL should come from them. 

Second, ensure the redirect URLs are following the expected format. For tenants under Common Super Domain (CSD), the redirect URLs are following the format: https://<IAS-TENANT>.cloud.sap/<[...]><IAS-TENANT>.ondemand.com. Hence, we advise to have the following configuration in your Corporate IdP:

• Maintain two Reply URLs
  • One following the ondemand.com format: https://<IAS-TENANT>.ondemand.com/<[...]><IAS-TENANT>.ondemand.com
  • Another following the cloud.sap format: https://<IAS-TENANT>.cloud.sap/<[...]><IAS-TENANT>.ondemand.com
    
• In the logout URL from your corporate IdP side, if your tenant is in CSD format, the expected URL format is https://<IAS-TENANT>.cloud.sap/saml2/idp/slo/<IAS-TENANT>.ondemand.com.

This would ensure all the redirect URLs are following the same Cloud.sap domain format. 

• 2674264 - Configuring SSO for SuccessFactors: Integrating Corporate IdP with Identity Authentication - SAP for Me
• 2976906 - Logout Redirect URL is not working when IAS is acting as a proxy - SAP for Me
• 2682874 - HTTP Status 400 - Identity Provider could not process the logout message received - Identity Authentication - SAP for Me
• 2768478 - [SSO] How to change redirect URLs for Single Sign On - SuccessFactors - SAP for Me

ias, successfactors, saml, single logout, slo, active session, concurrent session, session logout, re-login blocked, domain mismatch, cloud.sap, ondemand.com, azure ad, entra id, reply url, acs, sp-initiated logout, sf , KBA , LOD-SF-PLT-IAS , Identity Authentication Services (IAS) With BizX , Problem