IDP SLO endpoint confusion

[Wessel, Keith William]

Hi,

I'm back to working on our IDP SLO support, and I'm either misunderstanding something or have something misconfigured. I can specify my singleLogoutService endpoint in metadata as /idp/profile/Logout, but I'm pretty sure I'm not supposed to call that directly. When I do, the session does seem to get terminated, but I'm not able to display info from the login context such as the entity ID of the requesting SP that initiated the SLO request. In fact, my JSP generates a null pointer exception.

So, I tried changing the singleLogoutService endpoint to /idp/profile/SAML2/Redirect/SLO. This one terminated my IDP session also, but it redirected me back to the SP to display a logout page. Since this is SP V2.5.1, I would expect the ASLO extension support to kick in and the IDP to not try and return control to the SP. But that doesn't seem to be happening.

Which endpoint should I be calling if I want my IDP session destroyed and a page to be displayed from the IDP and also want to be able to access the request passed in? If my first attempt was correct and loginContext should be available, I certainly must be doing something wrong to get a null pointer exception.

Thanks,
Keith

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130606/8cb4f744/attachment.html