<div dir="ltr">Thank you for your response. The logout I am trying to do is via the "Shibboleth.sso/Logout" in the default SP config. It is configure to do both a Local and SAML2 logout action. When it tries to do the SAML2 logout action, that's when I see the error page and the connection attempt to the IdP back-channel. My point is that it looks like my back-channel communication isn't working at all (initial connection or anything afterward).<div>
<br></div><div style>I am using Apache to proxy the HTTPS via an AJP connector on port 8009, using a guide I found online. However, I am letting Tomcat host 8443 directly. Does that change anything about your suggestion?</div>
<div style><br></div><div style>I will also work on adding attributes into the SAML assertion. I didn't really need any for the proof of concept I was working on, but I will put some in there.</div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Oct 8, 2013 at 10:09 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 10/8/13 10:05 AM, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
><br>
>If you're using Apache in front of the IdP, not doing that might be one<br>
>fix.<br>
<br>
</div>But of course the underlying fix is, don't use the back channel and fix<br>
your attribute release issue at the IdP.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Adam Portier<br><div>Linux Administrator</div><div>IITS Core Technologies</div><div>Haverford College</div><div>W: 610-896-2974</div>
<div>C: 240-409-9759</div></div>
</div>