SAML OneLogin with SSO Circle : LogoutRequest returns StatusCode Requester instead of Success

Question

Using the onelogin sample app as SP with sso circle as IdP, login via SSOCircle IdP works, but the LogoutRequest, after being validated, returns a LogOutResponse with StatusCode Requester instead of Success :

<samlp:LogoutResponse  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
ID="xxxxxxxxxxxxxxxxxxxxx" Version="2.0" IssueInstant="2018-03-28T07:50:49Z" Destination="http://localhost:8080/onelogin-saml/sls.jsp" InResponseTo="ONELOGIN_hexahexahexa">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.ssocircle.com</saml:Issuer>
<samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<samlp:StatusCode xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
</samlp:StatusCode>
</samlp:Status>
</samlp:LogoutResponse>

IdP initiated Logout works.

I cannot figure out what am i missing in the properties configuration :

onelogin.saml2.sp.single_logout_service.url=http://localhost:8080/onelogin-saml/sls.jsp
onelogin.saml2.sp.single_logout_service.binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
onelogin.saml2.sp.nameidformat=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
onelogin.saml2.idp.single_logout_service.url=https://idp.ssocircle.com:443/sso/IDPSloRedirect/metaAlias/publicidp
onelogin.saml2.idp.single_logout_service.response.url=
onelogin.saml2.idp.single_logout_service.binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

Any input would be warmly welcome.

Rigoberta Raviolini Rigoberta Raviolini · Accepted Answer · 2018-03-28T13:39:18

thanks to the onelogin contributors, i could solve the problem by storing the nameId, sessionId and nameIdFormat into the session at login, and then use them as parameters when calling the logout method. see closed issue for full code here.

SAML OneLogin with SSO Circle : LogoutRequest returns StatusCode Requester instead of Success

1 Answers