SLO Request Not Signed

[Brent Putman]

On 4/13/17 5:30 PM, Brian Moon wrote:
> Hello all,
>
> I am trying to get the Single Logout to propagate to my SPs, but I am
> running into an issue where the request being sent to an SP is not
> signed (and thus being rejected by the SP). 

> 2017-04-13 13:59:24,895 - DEBUG
> [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:418]
> - Profile Action PopulateBindingAndEndpointContexts: Resolved
> endpoint at location https://mysp/sp/logoutURL using binding
> urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
>
> 2017-04-13 13:59:24,947 - DEBUG
> [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]
> - Looking up message encoder based on binding URI:
> urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

> 2017-04-13 13:59:24,974 - INFO
> [Shibboleth-Audit.LogoutPropagation:241] -
> 20170413T205924Z|||https://mysp/sp|http://shibboleth.net/ns/profiles/saml2/logout|https://myidp/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|Value
> <https://mysp/sp%7Chttp://shibboleth.net/ns/profiles/saml2/logout%7Chttps://myidp/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect%7CValue>
> Removed||||Value Removed||


Based on the above log messages, the XML LogoutRequest would not be
signed with an XML signature; indeed it can not be, that would violate
the Redirect binding spec.  Instead this would be a binding-level
signature, represented by a Signature query parameter on the redirect URL.

To confirm, examine the actual redirect URL on the wire to see whether
it carries a 'Signature' query param.

If Signature is not present, then maybe we have a bug around
resolving/populating the signing creds for the logout case.  I'm not
that familiar with this code in the IdP, but Scott would probably know
better.

If Signature is present, then either SP has a bug or it simply doesn't
support this binding for LogoutRequests, or something like that.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170413/a0a46c95/attachment.html>