SP not processing SAML2 Logout

[Catalin Iosif]

Hello,

I'm trying to configure SAML global logout for an app, but it seems that only the local logout is processed. The IDP supports single logout. Shibboleth SP is configured to process SAML2 and then Local profile. Here are the logs I gett from shibd when I call the default /Logout trigger from the browser:

----------
2024-03-07 11:07:10 DEBUG Shibboleth.Listener [2] [default]: dispatching message (default/Logout::run::SAML2LI)
2024-03-07 11:07:10 DEBUG Shibboleth.SessionCache [2] [default]: searching for session (_7f79791acabb4b344b968d9d303adda2)
2024-03-07 11:07:10 DEBUG Shibboleth.Listener [2] [default]: dispatching message (default/Logout::run::LocalLI)
2024-03-07 11:07:10 DEBUG Shibboleth.SessionCache [2] [default]: searching for session (_7f79791acabb4b344b968d9d303adda2)
----------

Here are the bindings for the logout in the IDP metadata:

----------
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://anonymized/auth/realms/anon/protocol/saml"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://anonymized/auth/realms/anon/protocol/saml"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://anonymized/auth/realms/anon/protocol/saml"/>
----------

And here's the SSO and logout tag in the SP:

----------
<SSO entityID="https://anonymized/auth/realms/anon"> SAML2 </SSO>
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
----------

This is happening with Shibboleth SP 3.3.0 on Apache 2.4. Do you think that there's something misconfigured? I'd appreciate any tips on how to further debug this.

Thanks!
Catalin


Catalin Iosif
Software Engineer

<tel:>  Bucharest, Romania
[nShift-website.png]  www.nshift.com<https://nshift.com/>  [twitter] <https://twitter.com/nShiftOfficial>   [linkedin] <https://www.linkedin.com/company/nshiftofficial>
[email banner nshift28feb.jpg]<https://bit.ly/3TcHLJB>

<https://nshift.com/solutions/emissions-tracker?utm_campaign=Sustainability&utm_source=signature&utm_term=emissions-tracker&utm_content=version-002>
[LinkedIn-follow-us-nShift]<https://www.linkedin.com/company/nshiftofficial>

nShift is ISO/IEC 27001:2022 certified.
We collect and process data with caution. Read more in our Privacy Policy<https://nshift.com/privacy-policy>.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240308/c8beb1a6/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: C2_signature_emailbannernshift28feb_89813b7f-68f0-4419-94ea-4c3cf39bd2c3.jpg
Type: image/png
Size: 21300 bytes
Desc: C2_signature_emailbannernshift28feb_89813b7f-68f0-4419-94ea-4c3cf39bd2c3.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20240308/c8beb1a6/attachment.png>