vCenter with Entra identity provider issues

[jeffj2000]

Has anyone been able to figure out how to get vCenter to actually logout of the SSO session, when you logout? There doesn't seem to be a way. Comparing to Nutanix,which allows you to configure a logout URL.

Currently of course in vCenter,if you logout, you can simply hit the URL again and your SSO session will just log you back in.

Thank you for any comments on this matter.

[hgdeloitte]

Hi.

A quick Google search provided this:

To get vCenter to fully terminate the Single Sign-On (SSO) session upon clicking logout, you must configure Single Logout (SLO) within your Identity Provider (IdP). By default, vCenter's native logout action only clears its own local application session tokens. It does not automatically invalidate the overarching session cookie held by external SAML or OIDC providers like Azure AD, Okta, or PingFederate.

[jeffj2000]

vCenter needs to provide a configuration where the logout will redirect to the end_session_endpoint in Entra. Nutanix actually has such a feature. I have a ticket open to see if anything can be configured outside of the vCenter gui to do this. Will keep the post updated.

[Allan Solomon Mejia]

I agree this is a gap in the current implementation. Logging out of the vCenter UI only terminates the local application session. It doesn't invalidate the authentication session maintained by Microsoft Entra ID. As long as the Entra session remains active, revisiting the vCenter URL can transparently authenticate the user again.

 

For environments using OIDC with Entra ID, proper logout would require vCenter to initiate the provider's end-session endpoint (RP-Initiated Logout) so the IdP session is also terminated. Until VMware adds native support for this behavior, administrators are generally limited to signing out of Entra separately, using browser-private sessions, or relying on Conditional Access and session lifetime policies to control reauthentication.

 

Please keep us posted on what VMware Support says. I'm sure others integrating vCenter with Entra ID would benefit from the outcome.

[jeffj2000]

I got some news on the ticket I opened, it is unfortunate news.

The engineering team say they do not support "deep logout" because that would log you out of all Entra sessions and they do not want to do that. I personally thought there was a way to log out of each Entra app, maybe I am mistaken.

They also followed up that statement with "There are currently no plans to support this in future VCSA builds"

This is unfortunate. Would you mind sharing how you use conditional access,etc. to try to secure this? 

[AlexeiR]

It is extremely well known SSO (including but not limited to, OIDC) problem.

One way to solve this (which we used here) is to adjust the logout page
using a reverse proxy so that it contains a link to the IdP dock / logout
page. Most systems (VC not an exception) allows to configure URL where you
are redirected after the logout. This URL may point to the IdP (EntraID in
your case, Ping One dock in our case) which handles the IdP session logout.

If a provider does not have such a page but has an explicit logout page
(like datacenter WIKI or JIRA) this page can be adjusted, or the reverse
proxy can edit it to add a link to the IdP logout.

Yes, this is a very common problem with all SSO systems. We recommend using
IdP SSO logout instead of application logout when applicable. (We run more
than 100+ SSO SP-s, but we use PingID not EntraID - they use common
principles but differ in many details. Only 5% - 10% of all SP supports
single logout functionality).

Alexei Roudnev
Senior network / data center architect
EIS Group

Cell: [phone]
Desk: [phone]
Slack: (Request access to EISgroup business space)

[Allan Solomon Mejia]

Jeff, thanks for the update and for checking with Engineering.

 

It's understandable that a global "deep logout" could impact other active Microsoft Entra sessions, but from a security standpoint, it would be valuable if vCenter supported an optional RP-initiated logout or Single Logout (SLO) flow where the identity provider supports it. Administrators could then choose the behavior that best aligns with their organization's security requirements.

 

In the meantime, Conditional Access policies, shorter sign-in frequency, MFA, Privileged Identity Management (PIM), and restricting vCenter access to trusted locations or compliant devices can help reduce the risk. That said, these controls don't fully address the lingering IdP session after logging out of vCenter.

 

Hopefully this is something the VMware product team will consider for a future release, as more organizations are standardizing on Microsoft Entra ID and OIDC for enterprise authentication.

[AlexeiR]

You can not do it this way. If you have an active SSO session with your IdP
(Microsoft Entra in your case), clicking on the application (VC in your
case) MUST login you automatically. Some IdPs allow configuring it the
other way (for example we can require a 2FA second factor check on every
login to some applications) but that's it. You are already authenticated
with the IdP, so the IdP only needs to log you into the application without
requiring additional actions.

If you log out from IdP it logs you out from ALL SSO sessions, with
possible exceptions where some sessions may exist independently (longer).
If you haven't logged out from the IdP, you will not be prompted to
reauthenticate when you click on application link (even if the app creates
a new session) except if IdP is specifically coded to ask authentication
every time (with your specific app).

So this has absolutely nothing to do with VMware, except for SLO support or
'where to redirect user on logout' support. This must be done on the IdP
side not the SP side (IDP is Entra and SP is VC). And SLO support is always
tricky and not too reliable.

Alexei Roudnev
Senior network / data center architect
EIS Group

Cell: [phone]
Desk: [phone]
Slack: (Request access to EISgroup business space)