SP logout produces IdP error

[Robert Rust]

On 9/19/17, 9:38 PM, "users on behalf of users-request at shibboleth.net" <users-bounces at shibboleth.net on behalf of users-request at shibboleth.net> wrote:

    >Could someone provide clarification on whether this is a problem that I
    >should correct on my IdP (at risk of breaking existing setups) or if I should
    >continue to focus on the SP side?
    
    That is not answerable. What is factual is that, if the problem is in fact the same, then the key in the metadata does not correspond to the decryption key you are running the IdP with. Which one is right and which one is wrong is not an objective question from the outside of the system.
    
    There is no possible way that any other SP running with the same metadata would work if they encrypted the ID but since most of them probably aren't encrypting there's not necessarily anything interesting about the fact that they are. Or they're not even doing SAML logout at all perhaps, as most in fact don't.
    And if there's different metadata given to different SPs with different public keys in it, then all bets are off and any change could have ripple effects. The IdP can decrypt with any number of keys it's told to use, so it's always possible to make it work if there were a need to temporarily allow for a key but then get rid of it later, but I can't tell you what keys are real or fake or missing or whatever.
    
    -- Scott
    
I think you answered my question in a rather round-about way.  What I was trying to get at is whether the key the SP is using to encrypt is a characteristic of the IdP (e.g. part of the IdP metadata), or if it’s a characteristic of the SP (part of the SP’s metadata).  My read on your answer is that the key is a characteristic of the IdP that the SP should know about and use.

-Robert