title: Logging out using passport-saml: req.logout() or Strategy.logout(), or both?
body: <p>I have a question regarding the proper way to logout a user when using passport-saml for authentication.</p>
  
  <p>The example script with passport-saml shows logging out as this:</p>
  
  <pre><code>app.get('/logout', function(req, res){
    req.logout();
    res.redirect('/');
  });
  </code></pre>
  
  <p>From what I can tell, this will end the local passport session, but it doesn't seem to send a logout request to the SAML IdP. When the user does another login, it redirects to the IdP but immediately redirects back with the authenticated user. Is there a way to logout with the IdP so that the user has to enter their password again when signing in to my site? I've seen other sites that use our IdP do this, so I think it's possible.</p>
  
  <p>I did notice in the passport-saml code that there is a <code>logout()</code> method on the passport-saml Strategy object, which doesn't seem to be called by <code>req.logout()</code>. So I tried switching the code to this:</p>
  
  <pre><code>app.get('/logout', function(req, res) {
      //strategy is a ref to passport-saml Strategy instance 
      strategy.logout(req, function(){
          req.logout();
          res.redirect('/');
      });
  });
  </code></pre>
  
  <p>But I got this error deep in XMLNode.js</p>
  
  <pre><code>Error: Could not create any elements with: [object Object]
     at XMLElement.module.exports.XMLNode.element (/.../node_modules/passport-saml/node_modules/xmlbuilder/lib/XMLNode.js:74:15)
     at XMLElement.module.exports.XMLNode.element (/.../node_modules/passport-saml/node_modules/xmlbuilder/lib/XMLNode.js:54:25)
     at XMLElement.module.exports.XMLNode.element (/.../node_modules/passport-saml/node_modules/xmlbuilder/lib/XMLNode.js:54:25)
     at new XMLBuilder (/.../node_modules/passport-saml/node_modules/xmlbuilder/lib/XMLBuilder.js:27:19)
     at Object.module.exports.create (/.../node_modules/passport-saml/node_modules/xmlbuilder/lib/index.js:11:12)
     at SAML.generateLogoutRequest (/.../node_modules/passport-saml/lib/passport-saml/saml.js:169:21)
  </code></pre>
  
  <p>Am I not calling this method correctly? Or should I not be calling this method directly and calling some other method instead?</p>
  
  <p>I see that in <code>generateLogoutRequest()</code> it is referring to two properties on the <code>req.user</code> that I'm not sure are there:</p>
  
  <pre><code>  'saml:NameID' : {
      '@Format': req.user.nameIDFormat,
      '#text': req.user.nameID
    }
  </code></pre>
  
  <p>If these properties are not there, will that cause this error? If so, I assume that maybe I need to ensure that these properties are added to the user object that is returned from the verify callback function?</p>
  
  <p>Thanks for any help anyone might be able to provide on this.</p>