AW: LogoutRequest not fulfilled by IdP

[Gruber Bernhard SAI sIT]

I had exactly the same problem, when I first tested the new Logout Feature of Shibboleth some months ago.
I made the same mistake: I did not include the NameQualifier in the NameID in the LogoutRequest.
After adding the NameQualifier, it worked fine.  

In the first mail of this thread vyal2k included the SAML-Messages.
In the Assertion the NameID was:
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="https://inw00003973/idp/shibboleth" SPNameQualifier="https://inw00003973:8443">vasu at abc.com</saml2:NameID>

But in the LogoutRequest it was:
<saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">vasu at abc.com</saml2:NameID>

They are simply not equal. The SAML specification says that the value and all attributes of the NameID must be equal to consider the NameID equal.
So try to include the NameQualifier and SPNameQualifier in the NameID of the LogoutRequest, too.