<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 4/13/17 5:30 PM, Brian Moon wrote:<br>
</div>
<blockquote
cite="mid:CAH-7XY+qeEmcohL4Pu+jx9xpmNjc6rwzj8R7LXfU_3EPLVQccA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-family:"times new
roman",serif">Hello all,</div>
<div class="gmail_default" style="font-family:"times new
roman",serif"><br>
</div>
<div class="gmail_default">I am trying to get the Single Logout
to propagate to my SPs, but I am running into an issue where
the request being sent to an SP is not signed (and thus being
rejected by the SP). <br>
</div>
</div>
</blockquote>
<br>
<blockquote
cite="mid:CAH-7XY+qeEmcohL4Pu+jx9xpmNjc6rwzj8R7LXfU_3EPLVQccA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default">
<div class="gmail_default">
<div class="gmail_default"><font face="monospace, monospace">2017-04-13
13:59:24,895 - DEBUG
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:418]
- Profile Action PopulateBindingAndEndpointContexts:
Resolved endpoint at location <a moz-do-not-send="true"
href="https://mysp/sp/logoutURL">https://mysp/sp/logoutURL</a>
using binding
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect</font></div>
<br>
<div class="gmail_default"><font face="monospace, monospace">2017-04-13
13:59:24,947 - DEBUG
[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]
- Looking up message encoder based on binding URI:
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect</font></div>
</div>
</div>
</div>
</blockquote>
<br>
<blockquote
cite="mid:CAH-7XY+qeEmcohL4Pu+jx9xpmNjc6rwzj8R7LXfU_3EPLVQccA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default">
<div class="gmail_default">
<div class="gmail_default"><font face="monospace, monospace">2017-04-13
13:59:24,974 - INFO
[Shibboleth-Audit.LogoutPropagation:241] -
20170413T205924Z|||<a moz-do-not-send="true"
href="https://mysp/sp%7Chttp://shibboleth.net/ns/profiles/saml2/logout%7Chttps://myidp/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect%7CValue">https://mysp/sp|http://shibboleth.net/ns/profiles/saml2/logout|https://myidp/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|Value</a>
Removed||||Value Removed||</font><br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
Based on the above log messages, the XML LogoutRequest would not be
signed with an XML signature; indeed it can not be, that would
violate the Redirect binding spec. Instead this would be a
binding-level signature, represented by a Signature query parameter
on the redirect URL.<br>
<br>
To confirm, examine the actual redirect URL on the wire to see
whether it carries a 'Signature' query param.<br>
<br>
If Signature is not present, then maybe we have a bug around
resolving/populating the signing creds for the logout case. I'm not
that familiar with this code in the IdP, but Scott would probably
know better.<br>
<br>
If Signature is present, then either SP has a bug or it simply
doesn't support this binding for LogoutRequests, or something like
that.<br>
</body>
</html>