<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
After the logged LogoutRequest message there is the line:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"signature verified against message issuer"<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I only see Assertion signing info (for the login) in signature.log but maybe there's a way to enable logging of message signature processing to confirm the above.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The shibd.log section (filtered for the main bits of the exchange) is attached. I don't notice anything obviously weird in it. The nameID doesn't have explicit IdP or SP qualifiers - that's about it (but other IdPs - such as ADFS - are also flaky about that
and SSO/SLO work fine).</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Does anything leap out at anyone? Or has anyone had the same problem? Or can anyone confirm that SLO works with Azure and so our setup is faulty?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Paul</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> 14 December 2021 14:46<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Anderson, Paul <Paul.Anderson@hw.ac.uk><br>
<b>Subject:</b> Re: Problem with SLO using Azure as IdP and Shibboleth as SP</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">****************************************************************<br>
Caution: This email originated from a sender outside Heriot-Watt University.<br>
Do not follow links or open attachments if you doubt the authenticity of the sender or the content.<br>
****************************************************************<br>
<br>
<br>
The most likely/simple answer is that the request isn't signed, but the SP will log that quite clearly.<br>
<br>
-- Scott<br>
<br>
<br>
</div>
</span></font></div>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<title>Untitled Document</title>
<div align="center">
<hr size="2" width="100%" align="center">
</div>
<p style="font-family: Arial, Helvetica Neue, Helvetica, sans-serif; font-size: 8pt;margin:0;">
Founded in 1821, Heriot-Watt is a leader in ideas and solutions. With campuses and students across the entire globe we span the world, delivering innovation and educational excellence in business, engineering, design and the physical, social and life sciences.
This email is generated from the Heriot-Watt University Group, which includes:</p>
<ol style="margin:0;">
<li style="font-family: Arial, Helvetica Neue, Helvetica, sans-serif; font-size: 8pt;">
Heriot-Watt University, a Scottish charity registered under number SC000278</li><li style="font-family: Arial, Helvetica Neue, Helvetica, sans-serif; font-size: 8pt;">
Heriot- Watt Services Limited (Oriam), Scotland's national performance centre for sport. Heriot-Watt Services Limited is a private limited company registered is Scotland with registered number SC271030 and registered office at Research & Enterprise Services
Heriot-Watt University, Riccarton, Edinburgh, EH14 4AS.</li></ol>
<p style="font-family: Arial, Helvetica Neue, Helvetica, sans-serif; font-size: 8pt;margin:0;">
The contents (including any attachments) are confidential. If you are not the intended recipient of this e-mail, any disclosure, copying, distribution or use of its contents is strictly prohibited, and you should please notify the sender immediately and then
delete it (including any attachments) from your system.</p>
</body>
</html>