> I tried ten latest Tomcat 8.0.x versions and all of them affected with this issue. Hmm. You should file a bug then. > What may be the issue? The SPs aren't signing their logout responses, so the result can't be trusted, and you told it to require signed logout messages. -- Scott