title: Where does the ds:Signature element go in a SAML LogoutRequest?
body: <p>The PingFederate 6.10 server responds with "Signature required", but the LogoutRequest it receives has a Signature element.  Is it in the wrong place?  How do I get the LogoutRequest to work?</p>
  
  <p>Perhaps also important: The PingFederate server log says "Exception occurred during request processing org.sourceid.saml20.profiles.StatusResponseException: Request was invalid XML".  I don't know which of these errors is accurate; the XML is well-formed, so I've been assuming "Signature required" is the error I should be paying attention to.</p>
  
  <p>(Note that I shortened the X509Certificate, SignatureValue, and Modulus elements' text to make the Request and Response more readable)</p>
  
  <p>Request:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;samlp:LogoutRequest Destination="https://pingfederate:9031/idp/SLO.saml2" ID="_63d86130-2d0e-0130-c98a-58b035fb0c5e" IssueInstant="2012-12-20T12:04:31Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;http://localhost:3000/auth/saml/metadata&lt;/saml:Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/ds:CanonicalizationMethod&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"&gt;&lt;/ds:SignatureMethod&gt;
              &lt;ds:Reference URI="#_63d8f1f0-2d0e-0130-c989-58b035fb0c5e"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"&gt;&lt;/ds:Transform&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;/ds:Transform&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/ds:DigestMethod&gt;
                  &lt;ds:DigestValue&gt;+7+DaMHOq7Up//Uoizpn5feSIxU=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;aAn0zuawy59ZXOTjx1...VULz7dVRd0g=&lt;/ds:SignatureValue&gt;
          &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;LS0tLS1CR...BVEUtLS0tLQo=&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;jacob&lt;/saml:NameID&gt;
  &lt;/samlp:LogoutRequest&gt;
  </code></pre>
  
  <p>Response:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;samlp:LogoutResponse Destination="http://localhost:3000/auth/saml/logout" ID="oWIAl1CbSxM-H9HZKm2L6LyTSDm" InResponseTo="_cab603f0-2dce-0130-c995-58b035fb0c5e" IssueInstant="2012-12-21T19:01:47.530Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;x&lt;/saml:Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
              &lt;ds:Reference URI="#oWIAl1CbSxM-H9HZKm2L6LyTSDm"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                  &lt;ds:DigestValue&gt;7HxtM74mkE/t3/UoR8ehE6Wa6x0=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;iGfTRlj25EYZnI496I5V...LHVJyUdgG4cF71wRT0Q=&lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;MIICFzCCAYC...gYl9535grCDQbs/zVY=&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
              &lt;ds:KeyValue&gt;
                  &lt;ds:RSAKeyValue&gt;
                      &lt;ds:Modulus&gt;jCMC58LLRg6wQLJQ...VNEll3WQdFPc/hezdjk=&lt;/ds:Modulus&gt;
                      &lt;ds:Exponent&gt;AQAB&lt;/ds:Exponent&gt;
                  &lt;/ds:RSAKeyValue&gt;
              &lt;/ds:KeyValue&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;samlp:Status&gt;
          &lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester" /&gt;
          &lt;samlp:StatusMessage&gt;Signature required&lt;/samlp:StatusMessage&gt;
      &lt;/samlp:Status&gt;
  &lt;/samlp:LogoutResponse&gt;
  </code></pre>