I'm having trouble getting Azure Single Sign out (SAML) to work as stated on http://msdn.microsoft.com/en-us/library/dn195588.aspx.
Single Sign on works just fine, but Sign out gives me the following error:
"ACS75015: Saml relying party's logout endpoint Url is required to process the LogoutRequest."
I sent the following logout request:
<samlp:LogoutRequest xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="idaa6ebe6839094fe4abc4ebd5281ec780" Version="2.0" IssueInstant="2014-01-31T07:10:49.6004822Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">[Issuer matches APP ID URI in Azure Active Directory]</Issuer><NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[Valid user email]</NameID></samlp:LogoutRequest>
Like so:
https://login.windows.net/[valid id]/saml2?SAMLRequest=[SAML-Redirect encoded request]&RelayState=3b48f8f2-ae1b-49fa-bed5-7dbbc69d6d7b
I have a Federation Medatadata document (being hosted using a self-signed SSL cert if that makes a difference) that looks something like this:
<?xml version="1.0" ?><md:EntityDescriptor ID="_25ab87e1-5861-4051-aebb-2ac72b8d1f5e" entityID="[ID matches the APP URI ID in Azure Active Directory]" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#_25ab87e1-5861-4051-aebb-2ac72b8d1f5e"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue> [digest]</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue> [signature value]</ds:SignatureValue><ds:KeyInfo><ds:KeyValue><ds:RSAKeyValue><ds:Modulus> [modulus]</ds:Modulus><ds:Exponent> [exponent]</ds:Exponent></ds:RSAKeyValue></ds:KeyValue></ds:KeyInfo></ds:Signature><md:IDPSSODescriptor><md:KeyDescriptor><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:KeyValue><ds:RSAKeyValue><ds:Modulus> [modulus]</ds:Modulus><ds:Exponent> [exponent]</ds:Exponent></ds:RSAKeyValue></ds:KeyValue></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="[logout url]"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="[login url]"/></md:IDPSSODescriptor></md:EntityDescriptor>
Can anyone offer advice as to what ACS75015 means and how to fix it? Searching Google and Bing for info returns very little useful information.