Repository navigation
SimpleSAMLphp does not handle asynchronous logout requests according to spec #2664
Description
A logout request sent to the SimpleSAMLphp IdP that contains the asynchronous SLO extension should not result in a response being sent back to the SP. The asynchronous SLO extension signals to the IdP that a response is not needed. But when a logout request is received by SimpleSAMLphp that contains the following, SimpleSAMLphp still attempts to respond:
<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="https://idpproxy.example.edu/simplesaml/module.php/saml/idp/singleLogout"
ID="_57b1048a00835d2fa345f8661ff90100"
IssueInstant="2026-08-04T20:38:32Z"
Version="2.0"
>
...
samlp:Extensions
<aslo:Asynchronous xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo" />
</samlp:Extensions>
...
</samlp:LogoutRequest>
If the SP metadata contains a logout endpoint, SimpleSAMLphp sends a response to it even with this element present. In trying to circumvent this, we removed the logout endpoint from the SP metadata. After this, SimpleSAMLphp still tried to respond and threw an unhandled exception because there was no SLO endpoint to respond to.
Desired behavior would be for SimpleSAMLphp to continue logging the user out without trying to respond to this SP.
Activity
tvdijen commentedon Aug 5, 2026
Working with SAML for 12 years every single day and I've never seen this spec before :')
https://docs.oasis-open.org/security/saml/Post2.0/saml-async-slo/v1.0/saml-async-slo-v1.0.pdf
Should be implemented.
P.S.: I don't think we're going against spec, because the SSP IDP metadata doesn't signal support for this (which is also part of the spec).
monkeyiq commentedon Aug 27, 2026
Code has been merged with simplesamlphp/saml2#423 relating to this.