<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12pt"><div class="" style=""><span style="font-size: 12pt;">Thanks for the Java SOAP Client example (https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaSOAPClientExample), i was able to successfully send LogoutRequest from Service Provider (that i am writing) to IDP through the back-channel and get a successful LogoutResponse.</span><br></div><div class="" style=""><br class="" style=""></div><div class="" style="">If only the client (SP) is making/initiating the SOAP call (or any Back-channel call) to IDP, and the SP doesn't support IDP making SOAP calls (any Back-channel), then does SP need to specify X509TrustManager to the TLSProtocolSocketFactory? I was able to get this working by passing null for X509TrustManager.</div><div class="" style=""><br class="" style=""></div><div
class="" style="">HttpClientBuilder clientBuilder = new HttpClientBuilder();</div><div class="" style="">clientBuilder.setHttpsProtocolSocketFactory(</div><div class="" style=""><span class="" style="white-space:pre"> </span>new TLSProtocolSocketFactory(new MyX509ExtendedKeyManager(spSigningCred.getPrivateKey(), spSigningCred.getEntityCertificate()), null));</div><div class="" style=""><span class="" style="white-space:pre"> </span></div><div class="" style="">And for the key manager, i used the SP's signing key credentials and it worked fine with Shibboleth2 IDP. Is it accepted by SAML standard to use KeyManager based on SP's signing key in the TLSProtocolSocketFactory ?</div></div></body></html>