SLO responses IdP3.2.x

[O'Dowd, Josh]

Sorry to keep working you this week...

I am still a little green on how the SLO transaction works.  If the SP is making a LogutRequest via SLO HTTP-POST binding, according to the location URL provided in the IdP metadata, does the IdP then send the LogoutResponse to the location URL provided in the SLO HTTP-POST binding of the SP metadata?

I am troubleshooting a problem where the SP is sending a LogoutRequest to the IdP HTTP-POST binding.  I see the IdP (in the logs) handling the request.  The user browser is landing on the URL provided by the SP HTTP-POST binding (the HTTP-Redirect binding location is the same as POST).  This is causing an error to occur in the service application and the developer is telling me the IdP isn't redirecting the user properly, and that the user should be redirected to a URL that is nowhere to be found.  They are asking if there is an option on the IdP to register a redirect URL for logout requests from that SP.

It is my understanding that with a SAML logout request to the IdP, that the IdP will respond to the corresponding binding location provided by the SP.  Am I not understanding this correctly?

Thanks for any insight.

Josh O'Dowd
Software Systems Engineer / Identity Access Management
Central IT, University of Montana

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161201/b0a93933/attachment.html>