Why does LogoutInitiator with chaining "SAML2 Local" does not redirect to the returnUrl supplied in relayState from Idp?

[Erik Cederlöf]

Hi!

Shibboleth SP 3.1.0.2 on Win64.
I'm trying to get the logout-flow working, but am failing on redirecting
the user to my designated "You have been logged out"-url. The logout-chain
is SAML2 and Local.

shibboleth2.xml:

    <RequestMapper type="Native">
        <RequestMap applicationId="default">
            <Host name="mysite.com" authType="shibboleth"
requireSession="true">
                <Path name="LoggedOut" authType="shibboleth"
requireSession="false"/>
                <Path name="Scripts" authType="shibboleth"
requireSession="false"/>
                <Path name="Content" authType="shibboleth"
requireSession="false"/>
            </Host>
        </RequestMap>
    </RequestMapper>
...
    <ApplicationDefaults entityID="https://mysite.com/Shibboleth.sso"
        REMOTE_USER="eppn subject-id pairwise-id persistent-id"
        signing="false" encryption="false" attributePrefix="AJP_">
...
        <Sessions lifetime="28800" timeout="3600" checkAddress="false"
            handlerURL="/Shibboleth.sso" handlerSSL="true"
            exportLocation="https://mysite.com/Shibboleth.sso/GetAssertion"
exportACL="127.0.0.1"
            idpHistory="false" idpHistoryDays="7" cookieProps="https"
sameSiteFallback="true">
...
            <LogoutInitiator type="Chaining" Location="/Logout">
                <LogoutInitiator type="SAML2"
template="bindingTemplate.html"/>
                <LogoutInitiator type="Local"/>
            </LogoutInitiator>
...

Request-flow:

1. User is directed to this url:
https://mysite.com/Shibboleth.sso/Logout?return=/LoggedOut
2. HTTP 302 to:
http://myidp.com/Logout?SAMLRequest=XXX&RelayState=https%3A%2F%2Fmysite.com%2FLoggedOut
3. IDP does its thing and HTTP302 with POST to:
https://mysite.com/Shibboleth.sso/Logout?SAMLResponse=YYY&RelayState=https%3A%2F%2Fmysite.com%2FLoggedOut&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=hF%2B4PaMIpTql0UG2aFC3suO6V2yiUip4YaYsPUTf6i6VUo7TSWgt8lMNCECQFL2mhlAFnLimIYNSp2mmpMQzttl8V6OoMVhNa1NHkrqgFeBWLa61dJAigCXfYp19V55%2Fro4cg6OvED1IEpzcyDIBPqGL5%2FMRusu6nH4%2BeDGUxPw%3D

with POST form data:
InResponseTo=_fb463ec2375e7be0a6239908ee3e46e0&RelayState=https%3A%2F%2Fmysite.com%2FLoggedOut&DestinationUrl=https%3A%2F%2Fmysite.com%2FShibboleth.sso%2FLogout

4. The above POST results in Shibboleth "Local Logout"-default page. I'm
not redirected to my desired https://mysite.com/LoggedOut.

If I cange the LogoutInitiator to only Local, I am redirected correctly to
my desired url. What am I missing in my setup?

Best regards, Erik
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200917/55e64077/attachment.htm>