IDP SLO endpoint confusion

[Cantor, Scott]

> I'm back to working on our IDP SLO support, and I'm either misunderstanding
> something or have something misconfigured. I can specify my
> singleLogoutService endpoint in metadata as /idp/profile/Logout,

You mean /LocalLogout? I think that's what I defaulted it to, though you can change it.

> but I'm
> pretty sure I'm not supposed to call that directly.

It's not meant to be in metadata, that's not a standard profile, it's for local use. The SAML endpoint for the partial logout support is what would be in metadata (or not, I think it might end up causing lots of trouble initially, but that's the long term state).

> When I do, the session
> does seem to get terminated, but I'm not able to display info from the login
> context such as the entity ID of the requesting SP that initiated the SLO
> request. In fact, my JSP generates a null pointer exception.

That's not a SAML endpoint, there's no requester, no nothing. It's just a cookie clearing handler, at the root of it. The only reason it's inside the code base like that is to allow the actual session to be purged, and to support Velocity templates.

> So, I tried changing the singleLogoutService endpoint to
> /idp/profile/SAML2/Redirect/SLO. This one terminated my IDP session also,
> but it redirected me back to the SP to display a logout page. Since this is SP
> V2.5.1, I would expect the ASLO extension support to kick in and the IDP to
> not try and return control to the SP. But that doesn't seem to be happening.

That's not what I observe while testing, so I suspecy either the extension's not there, or you think it's hitting the IdP and it's really not, just hitting the local logout hook in the SP. What does it actually say in the log?

> Which endpoint should I be calling if I want my IDP session destroyed and a
> page to be displayed from the IDP and also want to be able to access the
> request passed in? If my first attempt was correct and loginContext should
> be available, I certainly must be doing something wrong to get a null pointer
> exception.

The latter, but you definitely have to start at the SP to use that endpoint.

-- Scott