SAP Knowledge Base Article - Preview

3796372 - SAML SLO - 403007 "Permission denied" on second SP logout when IdP session already terminated (shared session across two

Symptom

In a site-group environment where CDC acts as SAML IdP for multiple SPs, the first SP's SLO request completes successfully and the CDC SSO session is terminated. When the second SP independently initiates its own SP-initiated SLO LogoutRequest to the CDC /slo endpoint, the proxy page fails and the user lands on the SAML error page. The CDC API call returns:

{
  "errorCode": 403007,
  "errorMessage": "Invalid namespace 'socialize' or method 'logout' or you do not have the required permissions to call it."
}

The SAML LogoutResponse is never returned to the second SP, leaving its session in an inconsistent state.


Read more...

Product

SAP Customer Data Cloud all versions

Keywords

403007 · 403002 · 403005 · 400006 · 400093 , KBA , CEC-PRO-CON , Admin Console (Settings, Administration, Queries / Reports) , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.