Supported use of /Shibboleth.sso/Logout?redirect-URL on SP 3.1.0.1

[Michael Brogan]

I have two test SPs:

One is Windows Server 2016 with IIS. It was an in-place upgrade from 3.0.x to 3.1.0.1.
The second is Windows Server 2019 which had 3.1.0.1 installed fresh (not an upgrade).

On the first SP I have been using a link like https://my-sp/Shibboleth.sso/Logout?return=https://my-idp/idp/profile/Logout to do a local logout and then redirect the browser to my IdP Logout endpoint. After upgrading this SP to 3.1.0.1 this logout link continued to work as before.

On the second SP (fresh install) that same logout link does not work. I get a HTTP 500 in the browser and the Shib logs record the following:

Shibboleth.IISNative [4040] iis_shib: Blocked unacceptable redirect location.

Some additional testing seems to indicate I can redirect to other pages on the same SP, but redirects to pages on another webserver fail.

Is the redirect policy configurable or baked in the code? Would you expect different behavior between an upgraded SP and a fresh install?

Michael W. Brogan
Technical Lead, Identity and Access Management
UW-IT, University of Washington
206-685-7521

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200427/dc795631/attachment.html>