ADFS Error upon logout (SAML)

Nitzan Harel 1 Reputation point
2020-05-28T23:12:40.94+00:00

Is there any difference between what ADFS and Azure support with respect to logout requests (is there a configuration on the ADFS side that needs to be set, does the SAML request need to include/exclude/get signed/etc. when sending to ADFS vs. Azure)?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,198 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2020-05-29T13:25:17.463+00:00

    There is generally a configuration to set on the Relying Party Trust in ADFS. A log-out endpoint has to be provided.

  2. Nitzan Harel 1 Reputation point
    2020-05-29T23:44:32.78+00:00

    I believe that the logout endpoints are configured correctly but I don't think this is it because I am not seeing those endpoints (the logout ones) being called even.
    And from the ADFS logs, we can observe the following error:

    The verification of the SAML message signature failed.
    Message issuer: XXXXX
    Exception details:
    MSIS7084: SAML logout request and logout response messages must be signed when using SAML HTTP Redirect or HTTP POST binding.

    This request failed.

    Does this help?

    0 comments