Hello fellow CAS SAML users,
We are having a hard-to-solve problem with Single Logout at an external IDP. The IDP is well established and has years of experience. However, we are getting an error when a user initiates a single logout. The IDP experience an error internal with the message “Missing signature element” when posting a SAML logout-request, and gives no response to the client. We are having a dialog with the IDP and they point out that the missing signature element is referring to the SigAlg query parameter present in the HTTP GET’s. The value for both SP’s are “&SigAlg= http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 <http://www.w3.org/2001/04/xmldsig-more#rsa-sha256&;>” The query-parameter SigAlg is present in our GET requests though, but I compared our applications logout procedure with another working application - a different service provider using the same IDP and there were some differences. My application using CAS 5.3.14 Another Service Provider GET 307 https://login.idp.org/adfs/ls/? GET 302 https://idp.org/IDP.ashx? POST 307 https://login.idp.org/adfs/ls/ POST 302 https://idp.org/IDP.ashx POST 302 https://another-sp.org/demo/logout.ashx GET 307 https://login.idp.org/adfs/ls/? GET 302 https://idp.org/IDP.ashx? GET 302 https://another-sp.org/demo/logout.ashx? Besides from “Another service provider” starts of by doing a POST to itself, and as an ending, the look very similar. Both doing GETS to https://login.idp.org/adfs/ls/ and https://idp.org/IDP.ashx? However, our application does POST’s to the same endpoints afterward. Why is that necessary? Fiddling with the property cas.slo.asynchronous from https://apereo.github.io/cas/5.1.x/installation/Configuration-Properties.html#single-logout resulted in that no HTTP GET’s were sent. But no effect at the IDP, still the missing signature element. We are naturally in a dialog with the IDP but we are running out of ideas. If anyone has experienced anything similar “Missing signature Element” or can point out any major misconceptions - please let us know. We can provide plenty of more information about the setup. On a note, our application is able to do a single logout initiated by another service provider. That part works flawlessly. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/7f09a4bb-d526-4ade-b391-8dba7c1d1542%40apereo.org.
