Error 404 after processing LogoutResponse from IdP on SP

[Robert Ayrapetyan]

Hello!

Trying to figure out why Shibboleth SP returns 404 (page not found) 
error instead of redirecting to "return" URL.

SP (shibboleth-sp-2.5.3-win64.msi) is installed with IIS7 (Windows 2008 
Server Standard)

Related config:

<Logout>SAML2 Local</Logout>
<LogoutInitiator type="Chaining" Location="/Logout" relayState="ss:mem">
     <LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
     <LogoutInitiator type="Local"/>
</LogoutInitiator>

Here are the steps taken:

1. User arrives on /Shibboleth.sso/Logout?return=https://www.returntome.com

2. SP redirects user to IdPs' SLO "redirect" page, passing 
"LogoutRequest" in "SamlRequest" param and "RelayState" param (equal to 
something like ss:mem:c1caf2f6c213673 - a reference to "return" URL).
On this step SPs'_shibsession_xxx cookie is being destroyed (which is 
expected).

3. IdP processes request, builds "LogoutResponse" and sends it back to 
SP along with "RelayState" param.
On this step "idpauth" cookie is being destroyed (which is also ok).

Expected:
SP processes "LogoutResponse", gets "return URL" from "RelayState" and 
redirects user to "return URL".

Actual:
SP processes "LogoutResponse" and returns
404 - File or directory not found.

Investigation:

If IdP skips signing of LogoutResponse, SP returns:
"Security of LogoutResponse not established."
This means following place has been reached:

if (logoutResponse) {
         if (!policy.isAuthenticated()) {
             SecurityPolicyException ex("Security of LogoutResponse not 
established.");
             if (policy.getIssuerMetadata())
                 annotateException(&ex, policy.getIssuerMetadata()); // 
throws it
             ex.raise();
         }
         checkError(logoutResponse, policy.getIssuerMetadata()); // 
throws if Status doesn't look good...

         // If relay state is set, recover the original return URL.
         if (!relayState.empty())
             recoverRelayState(application, request, response, relayState);
         if (!relayState.empty())
             return make_pair(true, 
response.sendRedirect(relayState.c_str()));

         // Return template for completion of global logout, or redirect 
to homeURL.
         return sendLogoutPage(application, request, response, false, 
"Global logout completed.");
     }

So 404 should be generated somewhere inside response.sendRedirect or 
sendLogoutPage.

I haven't made further investigation due to compilation issues in 
windows env (too many dependencies to setup/configure, sorry...).

Workaround:

Just redirect user "somewhere" on step 3, destroying idp cookie, and not 
return anything back to SP. This works pretty well, because both SP and 
IDP cookies/sessions are destroyed at this moment.
This is just better then nothing, hope community will help to resolve 
described issue. Thanks!