SLO responses IdP3.2.x

[Cantor, Scott]

On 12/2/16, 5:19 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

>    Using some debugging tools on the browser, I can see that the SP is doing a SAML LogoutRequest to the IdP 
> HTTP-Redirect binding endpoint via a 302 redirect to the browser.  The IdP is handling the request.  We do not
> propagate Logout requests but the IdP is successfully ending the service and SSO session, and the user ends up
> on the IdP logout view.  Problem now is that the SP session is still active, and I am not seeing the IdP send any
> response.  Nor am I seeing any errors.

Given that you're on 3.2, I'm not prepared to go looking for what releases we fixed what bugs in. I know there are flow completion bugs that got fixed. So try 3.3 and/or check the bug list basically.

Also, if you don't propagate logout but don't actually prompt the user for that choice, that means you modified the templates, and I can't vouch for what you changed of course.

> Shouldn't the IdP be sending a response in this scenario?

Yes.

-- Scott