SP SLO responses not signed

[Sternath, Elmar]

Dear experts,

I get the following error message from my IdP after the SP's response to an IdP's SLO request:

server_error: SAMLResponse message MUST be signed when using an asynchronous binding (POST or Redirect)

This is how the SAML response looks like:

<samlp:LogoutResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://test.auth0app.com/samlp/<client_id>/logout" ID="_f85ee87cf930ce3487d55786d29d67f6" InResponseTo="_570ddd7e15a32ee12c51" IssueInstant="2024-08-13T13:56:51Z" Version="2.0" > <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://testapp.example.org/SAMLTest/shibboleth</saml:Issuer> <samlp:Status> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /> </samlp:Status> </samlp:LogoutResponse>

SAML requests from the SP are signed properly. Here is an excerpt from my shibboleth2.xml:

   <ApplicationDefaults entityID=https://testapp.example.org/SAMLTest/shibboleth
                         REMOTE_USER="eppn persistent-id targeted-id" signing="true">

        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true" handlerURL="/SAMLTest/Shibboleth.sso" cookieProps="https">
            <SSO entityID="urn:test.auth0app.com"> SAML2 SAML1 </SSO>

            <!-- SAML and local-only logout. -->
            <Logout asynchronous="false">SAML2 Local</Logout>

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="true"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

Can anyone advise how to configure the SP so that not only login requests, but also logout requests are signed?

Thanks and br,
Elmar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240813/d9e35095/attachment.htm>