<div dir="ltr">I am setting up SSO for Google Apps for Education. I followed a great write up at:<div><br></div><div><a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1404895929/Google+Apps+for+Education">https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1404895929/Google+Apps+for+Education</a><div><br></div><div>I am able to login successfully. That looks great. The problem is trying to set up the logout functionality. </div><div><br></div><div>In my relyingparty.xml I followed the instructions for above and have:</div><div>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><bean parent="RelyingPartyByName" c:relyingPartyIds="REDACTED"></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span><property name="profileConfigurations"></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span><list></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span><bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptNameIDs="false" /></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span></list></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span></property></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span></bean></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style="">This produces this error in the logs: </span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style=""><br></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style=""><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0);font-family:Menlo;font-size:11px">Error message = WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:118] - Profile Action SelectProfileConfiguration: Profile <a href="http://shibboleth.net/ns/profiles/saml2/logout">http://shibboleth.net/ns/profiles/saml2/logout</a> is not available for RP configuration EntityNames[REDACTED,] (RPID REDACTED)</span> </span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style=""><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style="">So I added in the SAML2.Logout to the relyingparty.xml:</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style=""><br></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><bean parent="RelyingPartyByName" c:relyingPartyIds="REDACTED"></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span><property name="profileConfigurations"></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span><list></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span><bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptNameIDs="false" /></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span><bean parent="SAML2.Logout" /></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span></list></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span></property></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style="">
</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span></bean></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal">This produces this error in the logs: </span><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">
</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:420] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint for relying party 'REDACTED': EndpointCriterion [type={urn:oasis:names:tc:SAML:2.0:metadata}SingleLogoutService, trusted=false]</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style="">Google does not provide metadata for this. At least I was not able to find any. So I had to create it as specified in the writeup. I have been searching for what Google uses for </span><span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif" style="" color="#000000">SingleLogoutService to add that to the metadata. But was not able to find a location property. I think I need to add an entry similar to this but I do not know how/where to find the correct Location. Has anyone set this up?</font></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif" style="" color="#000000"><br></font></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif" style="" color="#000000">For example:</font></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif" style="" color="#000000"><br></font></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(180,36,25)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><SingleLogoutService </span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">Binding</span><span class="gmail-s3" style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">=</span><span class="gmail-s4" style="font-variant-ligatures:no-common-ligatures">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal">
</p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">Location</span><span class="gmail-s3" style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">=</span><span class="gmail-s4" style="font-variant-ligatures:no-common-ligatures">"<a href="https://accounts.google.com/logout">https://accounts.google.com/logout</a></span><span class="gmail-s4" style="font-variant-ligatures:no-common-ligatures">"</span><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"> /></span></p>
<div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><p><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"><font size="1">Steve Herrera</font></span><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"><font size="1"><br>Information Security<br></font></span><span style="color:rgb(31,73,125);font-family:Arial,sans-serif;font-size:7.5pt">Bradley University<br></span><span style="color:rgb(31,73,125);font-family:Arial,sans-serif;font-size:7.5pt">Phone: 309 / 677-2336<br></span><span style="color:rgb(31,73,125);font-family:Arial,sans-serif;font-size:7.5pt">FAX: 309 / 677-3460<br></span><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:rgb(31,73,125)">Email: </span><u><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:blue"><a href="mailto:sherrera@fsmail.bradley.edu" target="_blank">sherrera@fsmail.bradley.edu</a></span></u></p></div></div></div></div></div></div></div>