Logout failing about pressbooks-saml-sso HOT 4 CLOSED

I can produce errors/warnings on test networks by taking the following actions:

1. Set SAML configuration values to match the following:
   
   (crucial value is the SingleLogoutService one -- it needs to be https://samltest.id/idp/profile/Logout)
2. Log in a user (rick, morty, or sheldon)
3. Log out as this user

At this point I see a message from SAMLtest.ID informing me that I was successfully logged out of SAMLtest's IdP. I'm asked if I'd like to log out of all services accessed. If I click yes, the system attempts to contact https://NETWORK.URL/wp/shibboleth/ at which time I'm informed that the logout to the service at that URL failed

If I leave the SingleLogoutService value set to its default value: https://samltest.id/idp/profile/SAML2/Redirect/SSO, I see the following error message when trying to logout:

This error message appears to come from the SAML library: https://github.com/onelogin/php-saml/blob/748abe18166a500b944835b9b07ed6129e3cd157/lib/Saml2/Response.php#L469-L486 + https://github.com/onelogin/php-saml/blob/master/lib/Saml2/LogoutResponse.php

from pressbooks-saml-sso.

Another client has reported a similar problem:

Seneca college sees a 'Signature validation failed. Logout response rejected' message after completing the logout flow.

This error appears to come from the underlying SAML library we depend on: https://github.com/onelogin/php-saml/blob/790a042f2d16a086a563793dab0eeb6a5a8c4e70/lib/Saml2/LogoutResponse.php#L195-L213

from pressbooks-saml-sso.

Just to confirm, the SLO for SAML test must be: https://samltest.id/idp/profile/SAML2/Redirect/SLO . Using that, the flow will work as expected for samltest.id

from pressbooks-saml-sso.

Reading: https://jpassing.com/2021/06/10/azure-ad-defaults-to-saml-logout-but-not-all-apps-support-that/

looks like the endpoint for SLO does not work. But if we use https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0 it works as expected. I think it depends on the IdP settings on Microsoft.

I added that on Integrations and seems to work now.

from pressbooks-saml-sso.