How does Shibboleth support back-channel SLO over SOAP?

[ofaklintrafo]

I am trying to get back-channel SLO to work over SOAP.

According to this page and other pieces of documentation it should work. 

https://wiki.shibboleth.net/confluence/display/IDP30/LogoutConfiguration#LogoutConfiguration-SAMLLogout

I have made a small test setup with a single Shibboleth and two Shibboleth
service providers.

SLO works when I configure the SingleLogoutService with the HTTP-Redirect
binding on the service provider and IdP. 

IdP metadata configuration:

     <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://idp.local/idp/profile/SAML2/Redirect/SLO" />

Service provider metadata configuration:

     <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://sp1.local/Shibboleth.sso/SLO/Redirect"/>

But when I try to do the SOAP back channel configuration it fails when I try
to initiate a log out from the IdP.

In the idp-process.log file I see the following events:

	2018-04-30 07:11:47,770 - TRACE
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:390]
- Profile Action PopulateBindingAndEndpointContexts: Candidate outbound
bindings: [urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect,
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST,
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign,
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact]
	2018-04-30 07:11:47,771 - DEBUG
[org.opensaml.saml.common.binding.AbstractEndpointResolver:220] - Endpoint
Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:
Returning 1 candidate endpoints of type
{urn:oasis:names:tc:SAML:2.0:metadata}SingleLogoutService
	2018-04-30 07:11:47,771 - DEBUG
[org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:86] -
Endpoint Resolver
org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate
endpoint binding 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP' not permitted
by input criteria
	2018-04-30 07:11:47,773 - DEBUG
[org.opensaml.saml.common.binding.AbstractEndpointResolver:130] - Endpoint
Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: No
candidate endpoints met criteria

It looks like the SOAP binding 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP'
is not permitted. And the log also tells me that this binding is not one of
the candidate outbound bindings.

Why is this so? Why is the SOAP binding not one of the permitted candidate
bindings.

This also corresponds with the list of SAML2 SLO bindinds which are defined
in 'system/conf/saml-binding-config.xml'.

    <util:list id="shibboleth.OutgoingSAML2SLOBindings">
        <ref bean="shibboleth.Binding.SAML2Redirect" />
        <ref bean="shibboleth.Binding.SAML2POST" />
        <ref bean="shibboleth.Binding.SAML2POSTSimpleSign" />
        <ref bean="shibboleth.Binding.SAML2Artifact" />
    </util:list>

I would be very helpful I could get some how Shibboleth supports
back-channel SLO over SOAP when the SOAP binding is not listed as one of the
permitted SLO bindings.





--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html