integrating Shibboleth SP 2 with ADFS, log out issue

[Vu, Kien]

Hi everyone,


We are having log-out issue when integrating Shibboleth SP 2 with ADFS. The
log-in is working fine but when I log out the Shibboleth SP 2, the ADFS is
not logged out.

Can someone please help me on this issue?

This is our Shibboleth config file:


<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">

        <OutOfProcess>
                <Extensions>
                        <Library path="/usr/lib64/shibboleth/adfs.so"
fatal="true"/>
                </Extensions>
        </OutOfProcess>
        <InProcess>
                <Extensions>
                        <Library path="/usr/lib64/shibboleth/adfs-lite.so"
fatal="true"/>
                </Extensions>
        </InProcess>



       <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false"
cookieProps="http">



         <SSO entityID="http://xxxxx/adfs/services/trust">
                         SAML2 SAML1 ADFS
            </SSO>



            <!-- SAML and local-only logout. -->
            <Logout>SAML2 ADFS Local</Logout>
            <!-- <LogoutInitiator type="Chaining" Location="/Logout"
relayState="cookie">
                                <LogoutInitiator type="SAML2"/>
                                <LogoutInitiator type="Local"/>
                        </LogoutInitiator> -->


            <Handler type="MetadataGenerator" Location="/Metadata"
signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session"
showAttributeValues="false"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <Errors supportContact="xxxx"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>


<Notify
    Channel="back"
        Location="https://xxxxx/auth/shibboleth/logout.php" />



                 <MetadataProvider type="XML" uri="
https://xxxx/FederationMetadata/2007-06/FederationMetadata.xml"
             backingFilePath="/etc/shibboleth/editedFederationMetadata.xml"
reloadInterval="180000" />





        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true"
reloadChanges="false" path="attribute-map.xml"/>

        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

        <!-- Default filtering policy for recognized attributes, lets other
data pass. -->
        <AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/>

        <!-- Simple file-based resolver for using a single keypair. -->


                <CredentialResolver type="File"
key="/etc/pki/tls/private/xxxx.key"
certificate="/etc/pki/tls/certs/xxxx.crt"/>

    </ApplicationDefaults>

    <!-- Policies that determine how to process and authenticate runtime
messages. -->
    <SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for
use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>

</SPConfig>


Many thanks,

Kien
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130325/005e7692/attachment-0001.html