SLO - The request cannot be fulfilled because the message received does not meet the security requirements of the login service.

SAML for ASP.NET
1

Hi,

We are currently using component space on a Service Provider (SP) web application. The client Identity Provider (IdP) in this case is running Shibboleth. SSO is working fine, but when trying to request SLO getting the following error message response:

[hr]Web Login Service - Message Security Error
The request cannot be fulfilled because the message received does not meet the security requirements of the login service.
[hr]
Currently have the saml config PartnerIdentityProviders configured as follows (renamed some entries for privacy):



<PartnerIdentityProvider
Name=“idp_name”
SingleSignOnServiceBinding=“urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST”
SingleLogoutServiceBinding=“urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST”
PartnerCertificateFile=“_________.cer”
SingleLogoutServiceUrl=“<a href=“https://www.idp.domain/idp/profile/SAML2/POST/SLO” “=””><a href=“https://www.idp.domain/idp/profile/SAML2/POST/SLO” “=”“><a href=“https://www.idp.domain/idp/profile/SAML2/POST/SLO””>https://www.idp.domain/idp/profile/SAML2/POST/SLO"</a></a><br/>SingleSignOnServiceUrl="<a href=“https://www.idp.domain/idp/profile/SAML2/POST/SSO” “=”“><a href=“https://www.idp.domain/idp/profile/SAML2/POST/SSO” “=””><a href=“https://www.idp.domain/idp/profile/SAML2/POST/SSO”“>https://www.idp.domain/idp/profile/SAML2/POST/SSO” />



I’ve attached the following logs for additional information:

– Logout_Post = Post made by our SP to IdP SLO.
– Logout_Response = Response back from IdP SLO.
– slo-error = Shibboleth IdP log provided by client with responses.


Not sure what we should troubleshoot from here? Thanks in advance for the help!

EDIT: Removed original log attachments from topic after resolution for privacy.

2

Normally Shibboleth expects the logout messages to be signed. To do so, please add the following to your configuration:

SignLogoutRequest=“true”
SignLogoutResponse=“true”

This also requires that you configure a local certificate/private key (eg PFX file) as part of your configuration. The private key is used to sign the logout messages. Shibboleth will need to be configured with the certificate so it can verify the signatures.

3
[quote]
ComponentSpace - 10/6/2020
Normally Shibboleth expects the logout messages to be signed. To do so, please add the following to your configuration:

SignLogoutRequest="true"
SignLogoutResponse="true"

This also requires that you configure a local certificate/private key (eg PFX file) as part of your configuration. The private key is used to sign the logout messages. Shibboleth will need to be configured with the certificate so it can verify the signatures.
[/quote]

Adding SignLogoutRequest="true" & SignLogoutResponse="true" to our configuration appears to have resolved the issue! Local certificate/private key was already in place so did not have to worry about that. Thanks for the great support and assistance!
4

You’re very welcome. Thanks for the update.