<div dir="ltr"><div><div>Hello dear list, <br></div>After some months of research I've been able to implement successfully a SingleSignOn that I'm integrating into a local Seafile server.<br></div><div>Since they don't have a Logout yet, I decided to implement my own. So that said, I can already do it in shibboleth 2.5.2, SSO works, I get a valid Session and so on. SingleLogout on 2.5.2 works posting the following SAML to SLO/POST with a correct response :<br><h1>Global Logout</h1>
<p><strong>Status of Global Logout:</strong> Logout completed successfully.</p><p>Now when I switch to another server where shibd -v is 2.6 the same setup, sending this SAML:<br><LogoutRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol"<br> ID="_e3c6e9137ea52ab86c7d54502bdaf466cc04e432fd"<br> Version="2.0"<br> IssueInstant="2017-10-17T11:51:23Z"<br> Destination="<a href="https://storage/Shibboleth.sso/SLO/POST">https://storage/Shibboleth.sso/SLO/POST</a>"<br> ><br> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://luckycloud.dev/sso/metadata">https://luckycloud.dev/sso/metadata</a></saml:Issuer><br> <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br> <ds:SignedInfo><br> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /><br> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>" /><br> <ds:Reference URI="#_e3c6e9137ea52ab86c7d54502bdaf466cc04e432fd"><br> <ds:Transforms><br> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /><br> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /><br> </ds:Transforms><br> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>" /><br> <ds:DigestValue>b5xHrw/y3YB5yOZ/jZcOqNbHqe8=</ds:DigestValue><br> </ds:Reference><br> </ds:SignedInfo><br> <ds:SignatureValue>CERT SIGNATURE</ds:SignatureValue><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate>CERT CONTENTS</ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </ds:Signature><br> <saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"<br> ><a href="mailto:martinico@gmail.com">martinico@gmail.com</a></saml:NameID><br></LogoutRequest><br></p></div><div><div><div><b>Delivers this response: <br></b></div><div>opensaml::FatalProfileException<br>SAML response reported an IdP error.<br><br>Error from identity provider:<br><br> Status: urn:oasis:names:tc:SAML:2.0:status:Requester<br> Sub-Status: urn:oasis:names:tc:SAML:2.0:status:RequestDenied<br> Message: Error processing request.<br></div><div><br></div><div>In the log says anything more. So I'm quite lost in the cloud here. I already teared many of my hairs out. <br></div><div>Can someone guide me on what I'm doing wrong in the IDP side for a LogoutRequest for 2.6 ?</div><div><br></div><div>Metadata config looks like this:</div><div><SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://storage.local/Shibboleth.sso/SLO/POST">https://storage.local/Shibboleth.sso/SLO/POST</a>" /><br><SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://storage.local/Shibboleth.sso/SAML2/Post-SimpleSign">https://storage.local/Shibboleth.sso/SAML2/Post-SimpleSign</a>"/></div><div><SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://sso.local/login">https://sso.local/login</a>"/></IDPSSODescriptor></div><div><br></div><div>Many thanks in advance! And please tell me if I need to supply any additional details.<br></div><div>-- <br><div class="gmail_signature"><div dir="ltr"><div>Martin<br></div><div><a href="http://fasani.de" target="_blank">Fasani.de</a><br></div></div></div>
</div></div></div></div>