Why does LogoutInitiator with chaining "SAML2 Local" does not redirect to the returnUrl supplied in relayState from Idp?

[Cantor, Scott]

On 9/17/20, 9:32 AM, "users on behalf of Erik Cederlöf" <users-bounces at shibboleth.net on behalf of erik at pambu.com> wrote:

>    If I decode the SAMLResponse it is "unfortunately" a Success-response sent back from the IDP.

Then the Local plugins shouldn't running, it's irrelevant. The template that should be getting displayed (erroneously) should either say something about global logout working or partial success depending on the status code it got. It should be the globalLogout template, not the local one.

> Is it possible to set DEBUG-log-level to somehow pinpoint what the Logout-flow does?

Set DEBUG if you want, I doubt it will show anything.

> As I have "SAML2" and "Local" in the chaining, it seems like an error that Local does not take RelayState into account?

That's not the problem. Take Local out, it shouldn't change anything.

-- Scott