title: Okta SAML SLO request AuthnFailed/Invalid Signature
body: <p>I am trying to perform an SP initiated SAML 2.0 SLO in PHP, my problem: LogoutResponse status code AuthnFailed, hence no IdP logout. According to the Okta (IdP) dashboard the reason is Invalid Signature.
  I am using robrichards/xmlseclibs security lib and POST binding. The request validates on <a href="https://www.samltool.com/validate_logout_req.php" rel="nofollow noreferrer">https://www.samltool.com/validate_logout_req.php</a> and through <a href="http://php.net/manual/en/domdocument.schemavalidate.php" rel="nofollow noreferrer">http://php.net/manual/en/domdocument.schemavalidate.php</a>.</p>
  
  <p>Here's my beautified request:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;samlp:LogoutRequest
      xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
      ID="_logout_1_5ab86804b6057"
      Version="2.0"
      Destination="https://dev-680804.oktapreview.com/app/catalystitdev680000_xxxx_1/exkeb8o4nbMQ7xxxxxxx/slo/saml"
      IssueInstant="2018-03-26T16:24:52+13:00"&gt;
      &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;https://xxxxxxx/&lt;/saml:Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;&lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/&gt;
              &lt;ds:Reference&gt;
                  &lt;ds:Transforms&gt;&lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;&lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;/ds:Transforms&gt;&lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
                  &lt;ds:DigestValue&gt;5SXEPj5gyXWuf/BXfZ7QTVrUuJaF3Khh...&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;TmAUPHY4rO...&lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;MIIFUzCCAzugAwIBAgI...&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"&gt;and...&lt;/saml:NameID&gt;
      &lt;samlp:SessionIndex&gt;_authn_5ab8680105723&lt;/samlp:SessionIndex&gt;
  &lt;/samlp:LogoutRequest&gt;
  </code></pre>
  
  <p>This is how I created my pkey and crt:</p>
  
  <pre><code>#!/bin/bash
  
  # https://github.com/mattermost/docs/blob/master/source/scripts/generate-certificates/gencert.md
  
  umask 377
  
  certname="${CRT_FILENAME:-"nzta-x509"}"
  openssl x509 \
      -in &lt;(
          openssl req \
              -days 3650 \
              -newkey rsa:4096 \
              -nodes \
              -keyout "${certname}.key" \
              -subj "/C=${CRT_C:-"NZ"}/L=${CRT_L:-"Wellington"}/O=${CRT_O:-"XXXX"}/OU=${CRT_OU:-"Sysadmins"}/CN=${CRT_CN:-"xxxx-xxxx"}"
          ) \
      -req \
      -signkey "${certname}.key" \
      -sha256 \
      -days 3650 \
      -out "${certname}.crt" \
      -extfile &lt;(echo -e "basicConstraints=critical,CA:true,pathlen:0")
  
  chmod 600 ${certname}.crt
  </code></pre>
  
  <p>I am running out of ideas. How can I get more error context. "Invalid Signature" doesn't help me much...</p>