Debugging Logout requests on SP.

[Friedrich Clausen]

Hello All,

I found a useful post [1] outlining how to disable the asynchronous Logout
extension in the Shibboleth SP so that AD FS (from Shibboleth SP to AD FS
IdP) will logout will work - what I have done is place
`asynchronous="false"` into the "Logout" element.

However the AD FS side still complains (generic message, I don't have
access to the logs) and I'd like to see the actual SAML logout messages
sent but, from the NativeSPLogging [2] page, it is not clear to me how to
accomplish this. I have tried adding the following to shibd.logger

log4j.category.Shibboleth-TRANSACTION.Logout=DEBUG, tran_log

but that does not show the SAML request as it is sent to the AD FS side. If
I can get the actual SAML message then I can be sure the extension is
disabled.

Many thanks,

Fred

[1]
http://shibboleth.1660669.n2.nabble.com/SAML-Logout-rejected-by-ADFS-tt7585261.html
[2] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogging
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140130/89b54c9d/attachment.html