SLO LogoutResponse from simplesamlphp
Darren Boss
Darren.Boss at alliancecan.ca
Tue Oct 3 23:39:14 UTC 2023
Second attempt at sending this, 1st attempt was held for moderation for size.
This is a very minor issue but one that I can't seem to find a solution for. I know, SLO is doomed to fail but I still try and get it working when it's still within my control.
If I log into two SPs, one using Shibboleth SP and the other using simplesamlphp and I logout of the Shib SP service first and then attempt a global logout, it works except the IdP doesn't like the LogoutResponse it gets back from simplesamlphp but my session is invalidated on the SP.
The IdP error in the logs is this:
ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:184] - Message Handler: SAML message intended destination endpoint URI required by binding was empty
ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:184] - Message Handler: SAML message intended destination endpoint URI required by binding was empty
WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
shib-idp;idp-process.log;dev;nothing;org.opensaml.messaging.handler.MessageHandlerException:
SAML message intended destination (required by binding) was not present
shib-idp;idp-process.log;dev;nothing; at org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler.checkEndpointURI(ReceivedEndpointSecurityHandler.java:186)
WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
If I logout from the simplesamlphp SP first and then click global logout, it's fine. I used saml tracer and found that in the LogoutResponse from simplesamlphp, there is no Destination in the LogoutResponse. Does anyone know how to configure simplesamlphp so it includes Destination in the LogoutResponse which I assume to be the issue here.
I had to set sign.logout to true before I could even get this far.
More information about the users
mailing list