Specifying prefixed namespace for SLO requests?

[Cantor, Scott]

> Doesn’t this effectively make it impossible to accept encrypted logout
> requests?  Or is it more common for SPs to include the namespace
> definitions in the encrypted snippets themselves?

SAML logout in general is relatively uncommon and I doubt encryption is used very often with it. I have little to no experience with how it works in practice.

My guess is so few implementations support it outside of the major products that it just doesn't come up much. Shibboleth IdPs didn't support inbound encryption until 3.0 and there's no use of it in any of the federations in academia, for example.

As a matter of practicality, it's understood (by us) that using XML Encryption really requires that the encrypted XML be well-formed (or is when I bother to refresh my memory about it). How much that's understood by others I couldn't say.

My SP has the same limitation. There are virtually no DOMs that implement the "parse with context" notion.

I suppose some kind of brute force workaround would be to try and manually pull in namespaces, but that's somewhat tricky to do in general if the fragment can be signed, though that's not a concern here.

-- Scott