Quantcast
Channel: Azure Active Directory forum
Viewing all articles
Browse latest Browse all 16000

Federation Metadata for Azure Single Sign out

$
0
0

I'm having trouble getting Azure Single Sign out (SAML) to work as stated on http://msdn.microsoft.com/en-us/library/dn195588.aspx.

Single Sign on works just fine, but Sign out gives me the following error:
"ACS75015: Saml relying party's logout endpoint Url is required to process the LogoutRequest."

I sent the following logout request:

<samlp:LogoutRequest xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="idaa6ebe6839094fe4abc4ebd5281ec780" Version="2.0" IssueInstant="2014-01-31T07:10:49.6004822Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">[Issuer matches APP ID URI in Azure Active Directory]</Issuer><NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[Valid user email]</NameID></samlp:LogoutRequest>

Like so:

https://login.windows.net/[valid id]/saml2?SAMLRequest=[SAML-Redirect encoded request]&RelayState=3b48f8f2-ae1b-49fa-bed5-7dbbc69d6d7b

I have a Federation Medatadata document (being hosted using a self-signed SSL cert if that makes a difference) that looks something like this:

<?xml version="1.0" ?><md:EntityDescriptor ID="_25ab87e1-5861-4051-aebb-2ac72b8d1f5e" entityID="[ID matches the APP URI ID in Azure Active Directory]" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#_25ab87e1-5861-4051-aebb-2ac72b8d1f5e"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>
          [digest]</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>
     [signature value]</ds:SignatureValue><ds:KeyInfo><ds:KeyValue><ds:RSAKeyValue><ds:Modulus>
            [modulus]</ds:Modulus><ds:Exponent>
            [exponent]</ds:Exponent></ds:RSAKeyValue></ds:KeyValue></ds:KeyInfo></ds:Signature><md:IDPSSODescriptor><md:KeyDescriptor><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:KeyValue><ds:RSAKeyValue><ds:Modulus>
              [modulus]</ds:Modulus><ds:Exponent>
              [exponent]</ds:Exponent></ds:RSAKeyValue></ds:KeyValue></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="[logout url]"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="[login url]"/></md:IDPSSODescriptor></md:EntityDescriptor>

Can anyone offer advice as to what ACS75015 means and how to fix it? Searching Google and Bing for info returns very little useful information.


Viewing all articles
Browse latest Browse all 16000

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>