LogoutResponse from Shib 5.1.0 causes 500 in Keycloak

[Cantor, Scott]

> I have noticed now that the difference is in how the SAML message is
> sent. In Shib 5.0.0 it sends the LogoutResponse using the SAMLResponse
> field in the POST to keycloak. But in Shib 5.1.0 it sends the
> LogoutResponse using the SAMLRequest field in the POST. Hence keycloak
> doesn't like it.

That would be a bug, I don't know what would have caused it (nor have I observed it). I'll attempt to reproduce, but please file it so it's tracked.

My guess is it's something to do with the CSP changes made to OpenSAML's templates.

-- Scott