Re: [keycloak-dev] Issue with single sign out using salesforce SP with keycloak IDP and also customizing the logout page

On 08/18/2016 10:06 PM, Rashmi Singh wrote: Is logout supported on both ends (i.e. SP and IdP)? The definition of support is in the metadata of each entity. Is there a SingleLogoutService binding with a valid location URL in each metadata? The vast majority of SAML problems are directly attributable to the metadata because that is what drives the conversation between the SP and IdP. You have access to both metadata because it was necessary to load the metadata in each party. If the problem is not the absence of SingleLogoutService then I would try tracing the flow. That is easy with the Firefox browser and the SAMLTracer add-on. That will let you see the exchange of messages and identify who the offending party is. This suggests the problem is not with the IdP. Keycloak uses the same URL for all services (don't assume this is always the case, it's just one implementation choice). If login to the same URL works a valid LogoutRequest to the same URL should also work, provided of course it a valid SAML Request. Are there any errors in the Keycloak log concerning invalid requests. Once again. using SAMLTracer will help nail down who is generating the error and what the content of the message was that induced it. -- John