Global Logout issues with 2-way SSL

[Cantor, Scott]

Please don't send the same message to two lists.


On 12/18/14, 6:05 PM, "federator" <wpadmin at identiainc.com> wrote:

>There is no way the SP is able to obtain the client's cert.  The question 
>is, is there anyway to define the OpenSAML security policy rule to use 
>SP's cert instead of the user cert to process the global logout message? 

Brent noted that this was a bug in V2 when I was building the same code in 
V3.

> Where is the configuration file that defines
> the OpenSAML's ClientCertAuthRule or how to define the rule 
>declaratively?

It's in the DONOTTOUCH sections at the end of the relying-party file in 
the security policy chains used by different profiles. The logout one is 
using a single policy for both front and back channel messages, and the 
client auth rule is there for the back-channel and would have to be turned 
off.

-- Scott