Why does LogoutInitiator with chaining "SAML2 Local" does not redirect to the returnUrl supplied in relayState from Idp?

[Erik Cederlöf]

If I decode the SAMLResponse it is "unfortunately" a Success-response sent
back from the IDP. Shibboleth-logs show nothing out of the ordinary. At
first I was specifying my entityId to be https://mysite.com/shibboleth, but
later changed it to https://mysite.com/Shibboleth.sso as the logout
response came into an URL based on my entityID. (I see also that
DestinationUrl and RelayState differ in the response querystring.)
Is it possible to set DEBUG-log-level to somehow pinpoint what the
Logout-flow does? As I have "SAML2" and "Local" in the chaining, it seems
like an error that Local does not take RelayState into account?

Thanks Scott.

Best, Erik

On Thu, Sep 17, 2020 at 2:53 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> Offhand I would guess the IdP is responding with failure in the
> LogoutResponse and not Success, but that's just guessing. The code does
> check for RelayState and treats it as a return location to recover based on
> the type of relayState setting the SP is using.
>
> It's moot since SPs cannot rely on control of the UI if they use SAML
> logout. Most IdPs will (and if they actually support SAML logout, have to)
> maintain control of the UI.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200917/9d16467d/attachment.htm>