R: Modify tag issuer in LogoutRequest

[Cantor, Scott]

On 11/9/16, 8:43 AM, "users on behalf of Marcello Marangio" <users-bounces at shibboleth.net on behalf of m.marangio at innova.puglia.it> wrote:

>    This generates what I expected:

I'm a little surprised it worked, I thought it created the Issuer element itself, but it must be checking for that. It really shouldn't, since all it would allow for is what you're doing, violating the profile, but I don't spend my life trying to prevent people from doing bad things.

> I cannot find anything in the saml specs that makes this legal. 
>    
>    Am I missing something again?

There are many software features that can be misused to produce invalid or inappropriate results.

-- Scott