Shibboleth SP logout issue

[Cantor, Scott]

> Should going to https://sp.example.edu/Shibboleth.sso/Logout be enough
> to trigger SAML2 logout, or does that only work with local?

It's sufficient. There can't be nothing in the log in that situation ahead of the final error. If the SAML2 handler fails, it would report the reason. Once it records that it's encoded the LogoutRequest, the only code after that is to remove any session in hand from the cache and then finish up, signaling that it has handled the request.

If it failed during basic housekeeping issuing the response back to the client, that would be logged. No matter what, it logs.

The error observed is what it would do if it logged an earlier error about being unable to issue a LogoutRequest, no metadata found, etc.

-- Scott