title: Single Logout second request fails in ADFS
body: <p>I have setup when I'm using Auth0 to SSO through ADFS into a Spring Security Application, using saml all the way through. So, it looks like this:</p>
  
  <pre><code>Auth0 ----&gt; ADFS ----&gt; SpringSecurity App.
  </code></pre>
  
  <p>I have control of Auth0, but it's simulating a third party that would integrate with our ADFS server.</p>
  
  <p>This works fine.  </p>
  
  <p>To do logout, I minimally want to destroy the sessions on the SpringSecurity App and the ADFS application.  When I call logout the first time, a SAML logout request gets passed to ADFS.  ADFS then passes a Logout request to Auth0, where it ends.  This destroys the session.</p>
  
  <p>However, if, without closing the browser, I SSO in again and then logout, ADFS rejects the logout request with a <code>urn:oasis:names:tc:SAML:2.0:status:Requester</code>, meaning it didn't like something about my request.</p>
  
  <p>I've been able to narrow it down to the fact that there is a <code>SAMLLogout</code> cookie, with a domain of my ADFS server set.  This appears to be set when the logout bounces over to Auth0, but is never removed. Calling logout when that cookie is present causes an error.  When I delete that one cookie, I can logout successfully (in that it destroys the ADFS session and sends a logout request to Auth0).  The cookie has a <code>Session</code> expiration, so closing and opening the browser also works.</p>
  
  <p>I can post token requests and responses, but I don't think it has to do with the tokens itself. They are all signed correctly, and ADFS doesn't report any errors when doing the logout.</p>
  
  <p>I don't necessarily need ADFS to call out to Auth0 (or any IdP) to destroy that session, I simply need it to destroy it's own session.</p>