Why does LogoutInitiator with chaining "SAML2 Local" does not redirect to the returnUrl supplied in relayState from Idp?

[Cantor, Scott]

On 9/18/20, 3:22 AM, "users on behalf of Erik Cederlöf" <users-bounces at shibboleth.net on behalf of erik at pambu.com> wrote:

> So when the IDP returns successfully, the Local-plugin should not be run! I completely misunderstood the fact that it is a 
> fallback mechanism.

If there's no metadata available to make SAML logout possible, then Local runs, yes. For a LogoutResponse, it's a given that it's processing that message as a SAML logout, that's not a "chain" of anything, nor is it an "initiator", that's the completion side and should be running at / SLO/Redirect (or POST) I believe. If that's not the path handling the LogoutResponse message, you've given the wrong metadata out.

>    Is the Destination-url incorrect, as it displays the Local Logout-page?

There is no such concept as Destination-url and it's illegal for it to be there. It's also not the problem.

There is no way you should be seeing the "Local Logout" page. It's processing a SAML logout response, that can only result in the global or partial success templates.

If you're seeing anything else, you've broken something and it can't actually be processing the message properly. Something on the order of giving the wrong endpoint to the IdP to use for the response maybe.

>    Are there any place I can read up on the details?

The code (i.e., no, not really).

I can't do anything else for you, see the list footer for why. Logout is out of bounds for free help on list.

-- Scott