title: SAML LogOutRequest processing failed on ADFS server
body: <p>I have ADFS server as an IdP. I have separate SP application. These are defined in circle of trust. SSO over SAML protocol is working fine. When I try SP initated log out request I got error on ADFS side :</p>
  
  <p><em>MSIS7000: The sign in request is not compliant to the WS-Federation language for web browser clients or the SAML 2.0 protocol WebSSO profile.</em></p>
  
  <p><strong>EDIT</strong> More detail message from ADFS Event Trace :</p>
  
  <p><em>MSIS7015: This request does not contain the expected protocol message or incorrect protocol parameters were found according to the HTTP SAML protocol bindings.</em></p>
  
  <p>I have reviewed mu log out SAML message and looks correct. Just to mention that same SP is loging out properly with ForgeRocks IdP (ex Sun OpenSSO).</p>
  
  <p>Saml loout request message :</p>
  
  <pre><code>&lt;samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                   ID="b00b3f55-f3e3-4935-9e91-da6bf8b62efd"
                   Version="2.0"
                   IssueInstant="2013-08-27T09:45:08Z"
                   Destination="https://00.00.00.00/adfs/ls/"
                   Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
                   NotOnOrAfter="2013-08-27T09:50:08Z"
                   &gt;
  &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;SPEntityId/&lt;/saml:Issuer&gt;                    
  &lt;saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"&gt;jsmith@company.com&lt;/saml:NameID&gt;
  &lt;samlp:SessionIndex&gt;_ea853497-c58a-408a-bc23-c849752d9741&lt;/samlp:SessionIndex&gt;
  </code></pre>
  
  <p></p>
  
  <p><strong>EDIT</strong></p>
  
  <p>Lan suggested to me that signing of the logout request messages is mandatory. He was right. In OASIS specification (<a href="http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf" rel="nofollow">http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf</a>) section 4.4.3.1. it is described. According with that I am sending now signed messages but I am having the same issue.</p>
  
  <p>Signed message :</p>
  
  <pre><code>&lt;samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                   ID="aed640c0-9455-49ea-9450-4ad7c08d98e7"
                   Version="2.0"
                   IssueInstant="2013-08-29T15:22:45Z"
                   Destination="https://server/adfs/ls/"
                   Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
                   NotOnOrAfter="2013-08-29T03:27:45Z"
                   &gt;
  &lt;saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
               Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"&gt;user&lt;/saml:NameID&gt;
  &lt;samlp:SessionIndex&gt;_677952a2-7fb3-4e7a-b439-326366e677db&lt;/samlp:SessionIndex&gt;
  &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;SPIssuer&lt;/saml:Issuer&gt;
  &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
      &lt;SignedInfo&gt;
          &lt;CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" /&gt;
          &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
          &lt;Reference URI="#aed640c0-9455-49ea-9450-4ad7c08d98e7"&gt;
              &lt;Transforms&gt;
                  &lt;Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;53jjPvQ2Ty1Z+VikwrUwW4Erj3k=&lt;/DigestValue&gt;
          &lt;/Reference&gt;
      &lt;/SignedInfo&gt;
      &lt;SignatureValue&gt;signed value&lt;/SignatureValue&gt;
      &lt;KeyInfo&gt;
          &lt;X509Data&gt;
              &lt;X509Certificate&gt;certificate&lt;/X509Certificate&gt;
          &lt;/X509Data&gt;
      &lt;/KeyInfo&gt;
  &lt;/Signature&gt;
  </code></pre>
  
  <p></p>
  
  <p>What I am doing wrong ? Should be specified some other endpoint on ADFS ? As I got is should be used same as for sign on requests (that are working perfectly on my side).</p>
  
  <p>Thanks,
  Rastko</p>