SLO Logout Propagation error - Resolver returned no EncryptionParameters

[Lipscomb, Gary]

Hi Scott,

It was the correct metadata, I used mdquery to check.
What I hadn't done was add to the metadata [1] the entry to use the correct override in relying-party.xml [2] which has the MDDriven suffix.
Our default entry in relying-party.xml has the MDDriven suffix only on SAML2.SSO so authentication worked.

Propagation of logout now working as expected for this vendor.

[1] metadata attributes
  <md:Extensions>
    <mdattr:EntityAttributes>
      <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
        Name="RelyingPartyOverride" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue>MetadataSpecifiedConfiguration</saml:AttributeValue>
      </saml:Attribute>

      <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/sso/browser/encryptionOptional" 
          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
          <saml:AttributeValue xsi:type="xsd:boolean">true</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/logout/encryptionOptional"
          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
          <saml:AttributeValue xsi:type="xsd:boolean">true</saml:AttributeValue>
      </saml:Attribute>
 
   </mdattr:EntityAttributes>
  </md:Extensions>

[2] relying-party.xml
        <bean id="csu.MetadataSpecifiedConfiguration" parent="RelyingPartyByTag">
             <constructor-arg name="candidates">
                 <list>
                    <bean id="OverrideIntercept" parent="TagCandidate"
                          c:name="RelyingPartyOverride"
                          c:format="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                          p:values="MetadataSpecifiedConfiguration" />
                  </list>
             </constructor-arg>
            <property name="profileConfigurations">
                <list>
                    <ref bean="Shibboleth.SSO.MDDriven" />
                    <bean parent="SAML2.SSO.MDDriven" />
                    <ref bean="SAML2.ECP.MDDriven" />
                    <ref bean="SAML2.Logout.MDDriven" />
                    <ref bean="SAML2.AttributeQuery.MDDriven" />
                    <ref bean="SAML2.ArtifactResolution.MDDriven" />
                    <bean parent="OIDC.SSO" />
                    <ref bean="OIDC.UserInfo"/>
                    <ref bean="OAUTH2.Revocation"/>
                    <ref bean="OAUTH2.Introspection" />
                </list>
            </property>
        </bean>

--Gary


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Tuesday, 8 February 2022 11:18
To: Lipscomb, Gary <glipscomb at csu.edu.au>; Shib Users <users at shibboleth.net>
Subject: Re: SLO Logout Propagation error - Resolver returned no EncryptionParameters

On 2/7/22, 4:33 PM, "Lipscomb, Gary" <glipscomb at csu.edu.au> wrote:

>    I've tried the below extension entries[2] in the metadata and I am still see the error[1].

Then that isn't the metadata it's using, perhaps a duplicate entry somewhere, or maybe you didn't adjust the parent beans enumerating the profiles to add the MDDriven suffix. I'm just guessing. Logging only goes so far with this feature.

-- Scott