I tried to choose several ways for implementing saml logout.
1. I sent https://ADFS_IP/adfs/ls/?wa=wsignout1.0 to ADFS server and made success logout, but I can't redirect on my service
2. I sent https://ADFS_IP/adfs/ls/IdInitiatedSignon.aspx to ADFS server and made signout manually and I had redirect in login page but I need to redirect on my service
3. I create Request Logout like this:
<samlp:LogoutRequest ID="_f576971e-5123-49e4-8152-80653dcdfb1a"
IssueInstant="2015-07-23T15:21:42.254Z"
Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><samlp:Issuer xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion">https://my_host/logout</samlp:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#_f576971e-5123-49e4-8152-80653dcdfb1a"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue/></ds:Reference></ds:SignedInfo><ds:SignatureValue/><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIC...</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">_933c8876-9128-431f-b250-08975fde2a24</saml2:NameID><saml2p:SessionIndex xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">8ee4bf85-6792-42f5-b038-a3342a0e0e17</saml2p:SessionIndex></samlp:LogoutRequest>
and sent to ADFS server like url - ADFS_HOST/adfs/ls/SignOut.aspx?SAMLRequest=nVbbk... with encoded my request but I read ADFS logs:
The Federation Service encountered an error while processing the SAML authentication request.
Additional Data Exception details: System.Xml.XmlException: MSIS0018: The SAML protocol message cannot be read because it contains data that is not valid. ---> System.InvalidOperationException: No corresponding start element is open. at System.Xml.XmlBaseReader.ReadEndElement() at Microsoft.IdentityModel.Protocols.XmlSignature.SignedInfo.ReadFrom(XmlDictionaryReader reader, TransformFactory transformFactory) at Microsoft.IdentityModel.Protocols.XmlSignature.Signature.ReadFrom(XmlDictionaryReader reader) at Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.ReadSignature() at Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.TryReadSignature() at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommonElements(XmlReader reader, SamlMessage message) --- End of inner exception stack trace --- at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommonElements(XmlReader reader, SamlMessage message) at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadLogoutRequest(XmlReader reader) at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadSamlMessage(XmlReader reader, NamespaceContext context) at Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.ReadProtocolMessage(String encodedSamlMessage) at Microsoft.IdentityServer.Protocols.Saml.Contract.SamlContractUtility.CreateSamlMessage(MSISSamlBindingMessage message) at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.Logout(HttpSamlMessage logoutMessage, String sessionState, String logoutState, Boolean partialLogout, Boolean isUrlTranslationNeeded, HttpSamlMessage& newLogoutMessage, String& newSessionState, String& newLogoutState, Boolean& validLogoutRequest)
And I don't know what way I must choose and why my logout request is wrong?