Error 404 after processing LogoutResponse from IdP on SP

[Cantor, Scott]

On 12/26/14, 10:27 PM, "Robert Ayrapetyan" <robert.ayrapetyan at gmail.com> 
wrote:

>It doesn't look easy to submit a bug/issue (all the ways found end up 
>with a "Contact JIRA admin" or selection of IDP-organizations I'm not 
>belonging to).

You can get an account at ProtectNetwork if you don't have an account 
anywhere, which it says right on the discovery page.

>I've checked logs and screenshots I've provided - they are really 
>messed-up (it must be SAMLResponse there, not SAMLRequest, sorry about 
>that). The very first message however looks right (all steps are 
>described correctly).

It clearly says SAMLRequest, which is what I noted. So if nothing else, 
the IdP here is broken, which hardly inspires confidence.

I doubt the SP will notice that specific minor detail of the binding spec 
and probably won't care if it sends a SAML response with the wrong 
parameter name, but the point is, that means the IdP is broken. Which 
means it could be broken in other ways that will turn out to be relevant 
to the problem.

>To simplify things, just check what happens after IDP replies with 
>"LogoutResponse" to IIS-based SP (url /Shibboleth.sso/SLO/Redirect) - you 
>will always see this 404 error.

If you file a bug, then when I do have time, I will. I still don't believe 
the SP itself ever returns a 404, which means whatever this is, it's 
probably environmental.

-- Scott