Ignore SLO fields in IdP metadata

[Peter Schober]

* goods <davidgoodwin at gmail.com> [2019-11-21 03:09]:
> The IdP metadata file generated by the aforementioned appliance contains SLO
> fields which I want Shibboleth to ignore. When I head to
> https://<domain>/Shibboleth.sso/Logout with the default <Logout>SAML2
> Local</Logout> in Shibboleth2.xml, I am redirected to the SLO URL in the IdP
> metadata. We do not have this functionality on the appliance configured
> properly causing a connection reset and the browser just hangs, never
> getting to the logout successful page (unless I go to that URL a couple more
> times in succession).

Why not deal with
"We do not have this functionality on the appliance configured properly"
directly and enable this on the appliance?

> The simple solution would be to remove these fields from the
> metadata however the file is signed by the appliance and removing
> these fields causes Shibboleth to report errors on startup related
> to the signature failing.

That statement doesn't make much sense to me: Either you're loading
the IDP metadata directly over the network from the IDP, in which case
you can't easily remove the line about SLO support.
Or you're loading the metadata from a local copy on disk at the SP, in
which case you can simply remove both the SLO support /and/ the
Signature element.
The software necessarily trusts local files because the configuration
that potentially had signature validation filters configured for that
local file is also loaded from... a local file.

-peter