LogoutResponse from Shib 5.1.0 causes 500 in Keycloak

Tomas Stenlund tomas.stenlund at telia.com
Sun Mar 17 13:43:47 UTC 2024


Hi,

I have been using Keycloak 23.0.7 with Shibboleth IdP 5.0.0 as an IdP 
broker and it works perfectly fine both login and logout flows.

But when I upgraded to the latest Shibboleth 5.1.0 the logout flow broke 
with keycloak returning a 500 when it got the LogoutResponse with the 
statuscode urn:oasis:names:tc:SAML:2.0:status:Success. There is no 
visible difference between the 5.0.0 and 5.1.0 Shib messages from what I 
can see but obviously there is something that differ.

I just wanted to know if there has been any changes from 5.0.0 to 5.1.0 
that would affect the logout flow on the Shib-side? I am currently 
increasing logs in keycloak now to see if I can spot anything that 
points me in the right direction.

Thanks a lot,

Tomas



More information about the users mailing list