Signing Backchannel LogoutResponses Option

[Timothy Legge]

Hi

According to
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631693#Notes
Responses are not signed if the response is being transmitted over HTTPS to
a non 443 port.  At least that's my interpretation.

I have setup a test SP that logs in successfully via a Shibboleth 4 IdP
that I have configured as a test.  The IdP logs in the user via LDAP and
saves the session to MySQL.  It then responds with an encrypted Assertion
which the SP correctly decrypts and uses..

If I request Logout via the HTTP-Redirect I get a properly signed
Successful LogoutResponse and the session is deleted from the database and
the SP works.

If I request logout via SOAP I get an UNSIGNED successful LogoutResponse
and the session is deleted from the database.  Unfortunately my test SP
does not like unsigned LogoutResponses.

Is it possible to configure Shibboleth to sign the SOAP based
LogoutResponse?

Tim

Timothy Legge
timlegge at gmail.com
timlegge at cpan.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230101/64871e50/attachment.htm>