SingleLogout Service Google Apps for education

[Steve Herrera]

I am setting up SSO for Google Apps for Education. I followed a great write
up at:

https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1404895929/Google+Apps+for+Education

I am able to login successfully. That looks great. The problem is trying to
set up the logout functionality.

In my relyingparty.xml I followed the instructions for above and have:

<bean parent="RelyingPartyByName" c:relyingPartyIds="REDACTED">

            <property name="profileConfigurations">

                <list>

                    <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:encryptNameIDs="false" />

                </list>

            </property>

        </bean>


This produces this error in the logs:


Error message = WARN
[net.shibboleth.idp.profile.impl.SelectProfileConfiguration:118] - Profile
Action SelectProfileConfiguration: Profile
http://shibboleth.net/ns/profiles/saml2/logout is not available for RP
configuration EntityNames[REDACTED,] (RPID REDACTED)


So I added in the SAML2.Logout to the relyingparty.xml:


<bean parent="RelyingPartyByName" c:relyingPartyIds="REDACTED">

            <property name="profileConfigurations">

                <list>

                    <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:encryptNameIDs="false" />

                    <bean parent="SAML2.Logout" />

                </list>

            </property>

        </bean>


This produces this error in the logs:


WARN
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:420]
- Profile Action PopulateBindingAndEndpointContexts: Unable to resolve
outbound message endpoint for relying party 'REDACTED': EndpointCriterion
[type={urn:oasis:names:tc:SAML:2.0:metadata}SingleLogoutService,
trusted=false]


Google does not provide metadata for this. At least I was not able to find
any. So I had to create it as specified in the writeup. I have been
searching for what Google uses for SingleLogoutService to add that to the
metadata. But was not able to find a location property. I think I need to
add an entry similar to this but I do not know how/where to find the
correct Location. Has anyone set this up?


For example:


<SingleLogoutService Binding=
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

                   Location="https://accounts.google.com/logout" />

Steve Herrera
Information Security
Bradley University
Phone: 309 / 677-2336
FAX: 309 / 677-3460
Email:  *sherrera at fsmail.bradley.edu <sherrera at fsmail.bradley.edu>*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220513/0fdd12d6/attachment.htm>