Why does LogoutInitiator with chaining "SAML2 Local" does not redirect to the returnUrl supplied in relayState from Idp?

[Erik Cederlöf]

OK, thanks for valuable information and your time! This will hopefully get
me on the right track.

Best regards, Erik

On Fri, Sep 18, 2020 at 3:10 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/18/20, 3:22 AM, "users on behalf of Erik Cederlöf" <
> users-bounces at shibboleth.net on behalf of erik at pambu.com> wrote:
>
> > So when the IDP returns successfully, the Local-plugin should not be
> run! I completely misunderstood the fact that it is a
> > fallback mechanism.
>
> If there's no metadata available to make SAML logout possible, then Local
> runs, yes. For a LogoutResponse, it's a given that it's processing that
> message as a SAML logout, that's not a "chain" of anything, nor is it an
> "initiator", that's the completion side and should be running at /
> SLO/Redirect (or POST) I believe. If that's not the path handling the
> LogoutResponse message, you've given the wrong metadata out.
>
> >    Is the Destination-url incorrect, as it displays the Local
> Logout-page?
>
> There is no such concept as Destination-url and it's illegal for it to be
> there. It's also not the problem.
>
> There is no way you should be seeing the "Local Logout" page. It's
> processing a SAML logout response, that can only result in the global or
> partial success templates.
>
> If you're seeing anything else, you've broken something and it can't
> actually be processing the message properly. Something on the order of
> giving the wrong endpoint to the IdP to use for the response maybe.
>
> >    Are there any place I can read up on the details?
>
> The code (i.e., no, not really).
>
> I can't do anything else for you, see the list footer for why. Logout is
> out of bounds for free help on list.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200918/b01801ce/attachment.htm>