IdPv3 SLO redirect request failures

[Cantor, Scott]

On 3/9/16, 12:32 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>These requests end up landing the user on an IdP error view with the OOB response basically saying that the application isn’t configured properly.

That generally means the SP metadata doesn't include logout support, so the IdP can't respond to it. The code is too layered and constructed in common to easily bypass the same behavior for one SAML profile vs. another. It's the same error you get if the SP doesn't have SSO endpoints.

> 
>The workaround that seems to be popular is for the SP to change to a local logout with a URL redirect to our ../idp/profile/Logout page.

Which isn't a SAML logout, so doesn't require the same metadata.

-- Scott