SLO responses IdP3.2.x

[O'Dowd, Josh]

Interesting, so yes, I did remove the propagate form, because we weren't interested in using that feature.  In doing so, I recklessly removed the:

<!-- Complete the flow by adding a hidden iframe. -->
                <iframe style="display:none" src="$flowExecutionUrl&_eventId=proceed"></iframe>

I am guessing this might be why the IdP isn't sending a response...  fingers crossed...

Josh


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, December 2, 2016 3:29 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: SLO responses IdP3.2.x

On 12/2/16, 5:19 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

>    Using some debugging tools on the browser, I can see that the SP is 
> doing a SAML LogoutRequest to the IdP HTTP-Redirect binding endpoint 
> via a 302 redirect to the browser.  The IdP is handling the request.  
> We do not propagate Logout requests but the IdP is successfully ending 
> the service and SSO session, and the user ends up on the IdP logout view.  Problem now is that the SP session is still active, and I am not seeing the IdP send any response.  Nor am I seeing any errors.

Given that you're on 3.2, I'm not prepared to go looking for what releases we fixed what bugs in. I know there are flow completion bugs that got fixed. So try 3.3 and/or check the bug list basically.

Also, if you don't propagate logout but don't actually prompt the user for that choice, that means you modified the templates, and I can't vouch for what you changed of course.

> Shouldn't the IdP be sending a response in this scenario?

Yes.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net