<div dir="ltr"><div class="gmail_default" style="font-family:"times new roman",serif">Interesting. In looking at the Apache log I do indeed see a Signature query param sent, complete with signature. Since I assume that this is using the signing cert, it makes me wonder why my SP is throwing an exception with the following errors:</div><div class="gmail_default" style="font-family:"times new roman",serif"><br></div><div class="gmail_default"><font face="times new roman, serif">No certificate in message when validating against fingerprint.</font><br></div><div class="gmail_default"><font face="times new roman, serif">Validation of received messages enabled, but no signature found on message.<br></font></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><br><font face="times new roman, serif">Brian Moon</font><br><font face="times new roman, serif">Senior System Administrator</font><br><font face="times new roman, serif">Enterprise Systems</font><br><font face="times new roman, serif">Santa Clara University</font><br><font face="times new roman, serif">Office: 408.554.4830</font><br><a href="mailto:bmoon@scu.edu" style="font-family:'times new roman',serif" target="_blank">bmoon@scu.edu</a><br></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Apr 13, 2017 at 4:34 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><span class="">
<p><br>
</p>
<br>
<div class="m_-5272050841985366731moz-cite-prefix">On 4/13/17 5:30 PM, Brian Moon wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_default">Hello all,</div>
<div class="gmail_default"><br>
</div>
<div class="gmail_default">I am trying to get the Single Logout
to propagate to my SPs, but I am running into an issue where
the request being sent to an SP is not signed (and thus being
rejected by the SP). <br>
</div>
</div>
</blockquote>
<br>
</span><blockquote type="cite">
<div dir="ltr">
<div class="gmail_default">
<div class="gmail_default"><span class="">
<div class="gmail_default"><font face="monospace, monospace">2017-04-13
13:59:24,895 - DEBUG
[net.shibboleth.idp.saml.<wbr>profile.impl.<wbr>PopulateBindingAndEndpointCont<wbr>exts:418]
- Profile Action PopulateBindingAndEndpointCont<wbr>exts:
Resolved endpoint at location <a href="https://mysp/sp/logoutURL" target="_blank">https://mysp/sp/logoutURL</a>
using binding
urn:oasis:names:tc:SAML:2.0:<wbr>bindings:HTTP-Redirect</font></div>
<br>
</span><span class=""><div class="gmail_default"><font face="monospace, monospace">2017-04-13
13:59:24,947 - DEBUG
[net.shibboleth.idp.saml.<wbr>profile.impl.<wbr>SpringAwareMessageEncoderFacto<wbr>ry:100]
- Looking up message encoder based on binding URI:
urn:oasis:names:tc:SAML:2.0:<wbr>bindings:HTTP-Redirect</font></div>
</span></div>
</div>
</div>
</blockquote>
<br><span class="">
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_default">
<div class="gmail_default">
<div class="gmail_default"><font face="monospace, monospace">2017-04-13
13:59:24,974 - INFO
[Shibboleth-Audit.<wbr>LogoutPropagation:241] -
20170413T205924Z|||<a href="https://mysp/sp%7Chttp://shibboleth.net/ns/profiles/saml2/logout%7Chttps://myidp/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect%7CValue" target="_blank">https://<wbr>mysp/sp|http://shibboleth.net/<wbr>ns/profiles/saml2/logout|<wbr>https://myidp/idp/shibboleth|<wbr>urn:oasis:names:tc:SAML:2.0:<wbr>bindings:HTTP-Redirect|Value</a>
Removed||||Value Removed||</font><br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br></span>
Based on the above log messages, the XML LogoutRequest would not be
signed with an XML signature; indeed it can not be, that would
violate the Redirect binding spec. Instead this would be a
binding-level signature, represented by a Signature query parameter
on the redirect URL.<br>
<br>
To confirm, examine the actual redirect URL on the wire to see
whether it carries a 'Signature' query param.<br>
<br>
If Signature is not present, then maybe we have a bug around
resolving/populating the signing creds for the logout case. I'm not
that familiar with this code in the IdP, but Scott would probably
know better.<br>
<br>
If Signature is present, then either SP has a bug or it simply
doesn't support this binding for LogoutRequests, or something like
that.<br>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>