IdPv3 SLO redirect request failures

[O'Dowd, Josh]

> That generally means the SP metadata doesn't include logout support, so the IdP can't respond to it. The code is too layered and constructed in common to easily bypass the same behavior for one SAML profile vs. another. It's the same error you get if the SP doesn't have SSO endpoints.

Thanks Scott, that helps me understand better what is happening.

> Which isn't a SAML logout, so doesn't require the same metadata.

Agreed, but it achieves the same end.  Our logout policy is that if you logout of a service, your SSO session is ended, moving forward.

Josh


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, March 9, 2016 10:45 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdPv3 SLO redirect request failures

On 3/9/16, 12:32 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>These requests end up landing the user on an IdP error view with the OOB response basically saying that the application isn’t configured properly.

That generally means the SP metadata doesn't include logout support, so the IdP can't respond to it. The code is too layered and constructed in common to easily bypass the same behavior for one SAML profile vs. another. It's the same error you get if the SP doesn't have SSO endpoints.

> 
>The workaround that seems to be popular is for the SP to change to a local logout with a URL redirect to our ../idp/profile/Logout page.

Which isn't a SAML logout, so doesn't require the same metadata.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net