Logout error message and issue with workaround

[tw77]

Summary

Two single institution clients, RMIT and Seneca, encountered an invalid_logout_response error message every time when testing logout during SSO configuration (RMIT in November 2023, Seneca in January 2024).

Logging out and all other aspects of SSO functionally worked for both clients, but this confusing error message appeared every time someone logged out after having logged in with SSO.

Both clients were able to use the same workaround to remove this error message, which was to change the SP Logout URL in their IdP from the SingleLogoutService value in our SP metadata to a generic https://rmit.pressbooks.pub/wp/wp-login.php?action=logout or https://pressbooks.senecapolytechnic.ca/wp/wp-login.php?action=logout. However, this workaround has the side effect of an additional, unwanted prompt upon logout:

More detailed notes from RMIT

See RMIT's explanation of the cause of the error message, the workaround, and the side effect of the workaround here (https://pressbooks.zendesk.com/agent/tickets/18449):

Once the user hits “Log Out” from the Pressbooks application:

The logout URL sending the SAML Logout Request from the app was https://rmit.pressbooks.pub/wp/wp-login.php?action=logout&redirect_to=https%3A%2F%2Frmit.pressbooks.pub%2F&_wpnonce=2059b118fa.

But the SingleLogoutService value in the SP metadata file is https://rmit.pressbooks.pub/wp/wp-login.php?action=pb_shibboleth_sls

Since these two values mismatched, we see an error message "invalid_logout_response"

To fix this, the IDP changed the Single Logout URL returned in the SAML Response to https://rmit.pressbooks.pub/wp/wp-login.php?action=logout so that it matched the URL sending the Logout request.

This worked (Error message didn’t appear again) but added the additional step to the logout process. See below:

1. User hits “log Out” from the app.

2. User gets redirected to the following prompt (additional step):

3. Upon hitting ‘log out’ from the additional prompt, user gets sent to the login page:

This page now shows the correct message “You are now logged out”.