SLO never being practical anyway notwithstanding, most issues amount to NameID mismatches between the LogoutRequest and the original Assertion, so that's missing the core comparison you need to debug via the log. -- Scott