0

I created a project with spring SAML2, i'm trying to integrate it with Azure AD, now single sign on flow looks pretty good, but single logout is not work properly.

I debugged the spring SAML2 implementation, it expected a signed SLO response, but actually Azure SLO response is non-signed, i already set sign option to Sign SAML response and assertions Anything else i need to configure to make SLO work? thanks.

Saml2LogoutResponseFilter.java

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
    ...
    Saml2LogoutValidatorResult result = this.logoutResponseValidator.validate(parameters);
    ...
}

OpenSamlLogoutResponseValidator.java

private Consumer<Collection<Saml2Error>> verifySignature(Saml2LogoutResponse response,
      LogoutResponse logoutResponse, RelyingPartyRegistration registration) {
  return (errors) -> {
    VerifierPartial partial = OpenSamlVerificationUtils.verifySignature(logoutResponse, registration);
    if (logoutResponse.isSigned()) {
      errors.addAll(partial.post(logoutResponse.getSignature()));
    }
    else {
      errors.addAll(partial.redirect(response));
    }
  };
}

Azure SLO response

<samlp:LogoutResponse ID="_f0961a83-d071-4be5-a18c-9ae7b22987a4" Version="2.0" IssueInstant="2013-03-18T08:49:24.405Z" InResponseTo="iddce91f96e56747b5ace6d2e2aa9d4f8c" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://login.microsoftonline.com/82869000-6ad1-48f0-8171-272ed18796e9/</Issuer>
  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
  </samlp:Status>
</samlp:LogoutResponse>

https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-out-saml-protocol#logoutresponse

zsts
  • 1
  • 1
  • According this thread https://learn.microsoft.com/en-us/answers/questions/1184652/invalid-signature-of-saml-logout-response-in-keycl, i modified spring source code to skip signature verification for SLO response – zsts Aug 30 '23 at 08:14

0 Answers0