Why does LogoutInitiator with chaining "SAML2 Local" does not redirect to the returnUrl supplied in relayState from Idp?

[Erik Cederlöf]

Sorry, I'm trying my best to wrap my head around the functionality. So when
the IDP returns successfully, the Local-plugin should not be run! I
completely misunderstood the fact that it is a fallback mechanism.

So when my IDP returns this SAML-response (with RelayState encoded in
querystring: https://mysite.com/LoggedOut):

<LogoutResponse xmlns="urn:oasis:names:tc:SAML:2.0:protocol"
ID="_8560757b-257c-4826-8b5d-4300854f05f8" Version="2.0"
IssueInstant="2020-09-18T07:14:22Z"
InResponseTo="_76db417c791ad3d811d830ce383cdae1" Destination="
https://mysite.com/Shibboleth.sso/Logout">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
http://myidp.com/Metadata</Issuer>
    <Status>
        <StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </Status>
</LogoutResponse>

Is the Destination-url incorrect, as it displays the Local Logout-page?
Are there any place I can read up on the details?

Thanks,
Erik

On Thu, Sep 17, 2020 at 3:41 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/17/20, 9:32 AM, "users on behalf of Erik Cederlöf" <
> users-bounces at shibboleth.net on behalf of erik at pambu.com> wrote:
>
> >    If I decode the SAMLResponse it is "unfortunately" a Success-response
> sent back from the IDP.
>
> Then the Local plugins shouldn't running, it's irrelevant. The template
> that should be getting displayed (erroneously) should either say something
> about global logout working or partial success depending on the status code
> it got. It should be the globalLogout template, not the local one.
>
> > Is it possible to set DEBUG-log-level to somehow pinpoint what the
> Logout-flow does?
>
> Set DEBUG if you want, I doubt it will show anything.
>
> > As I have "SAML2" and "Local" in the chaining, it seems like an error
> that Local does not take RelayState into account?
>
> That's not the problem. Take Local out, it shouldn't change anything.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200918/859fe7d6/attachment.htm>