SAML Logout rejected by ADFS

[andyp]

I'm having some difficulty getting ADFS to accept a SAML logout request from
Shibboleth-SP.  Unfortunately the ADFS logs (with tracing turned on) are of
little use in trying to determine why ADFS won't accept what appears to be a
well-formed request - see below.  No obvious error messages - the request is
signed, the name ID and the session index match what was issued on the
sign-on request, etc.  FWIW SSO is working fine.

The only item I'm curious about is whether ADFS supports the async profile
extension - I can't find anything in the MS docs that indicate if it does or
not.  In the interest of excluding that from the list of potential interop
issues, is there a way to tell Shibboleth-SP to turn this extension off and
/ or omit it from the logout request?

<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="[server]/adfs/ls/" ID="_f09256b9a34e603b9a3d8068aa9aa3e1"
IssueInstant="2013-03-07T12:40:25Z" Version="2.0">
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">[SP Entity
ID]</saml:Issuer>
  <samlp:Extensions>
    <aslo:Asynchronous
xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo" />
  </samlp:Extensions>
  <NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">ca3579be-b10f-4117-ab67-88114e57f3cc</NameID>
 
<samlp:SessionIndex>_83e0bb6e-b901-4675-ab27-8e34a093c07f</samlp:SessionIndex>
</samlp:LogoutRequest>



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SAML-Logout-rejected-by-ADFS-tp7585261.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.