<div dir="ltr">Hello All,<div><br></div><div>I found a useful post [1] outlining how to disable the asynchronous Logout extension in the Shibboleth SP so that AD FS (from Shibboleth SP to AD FS IdP) will logout will work - what I have done is place `asynchronous="false"` into the "Logout" element. </div>
<div><br></div><div>However the AD FS side still complains (generic message, I don't have access to the logs) and I'd like to see the actual SAML logout messages sent but, from the NativeSPLogging [2] page, it is not clear to me how to accomplish this. I have tried adding the following to shibd.logger</div>
<div><br></div><div>log4j.category.Shibboleth-TRANSACTION.Logout=DEBUG, tran_log<br></div><div><br></div><div>but that does not show the SAML request as it is sent to the AD FS side. If I can get the actual SAML message then I can be sure the extension is disabled.</div>
<div><br></div><div>Many thanks,</div><div><br></div><div>Fred</div><div><br></div><div>[1] <a href="http://shibboleth.1660669.n2.nabble.com/SAML-Logout-rejected-by-ADFS-tt7585261.html">http://shibboleth.1660669.n2.nabble.com/SAML-Logout-rejected-by-ADFS-tt7585261.html</a></div>
<div>[2] <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogging">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLogging</a></div></div>