Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Facing issue in http redirect logout request
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 53%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKJ%3C/text%3E%3C/svg%3E)
kumaran J
1
Reputation point
Hi team,
Couldn't verify the logout request received from the ADFS server.
Received query String SAMLRequest=lZLbat0wEEV%2FxehdlizLlwjH9NBDwJAm0IQ%2B9CXI1pzGjS05GrmEfH19SSil4UBfh9nai6WpUI%2FDpK7dDzeHr%2FA8A4aoOV6SBylLo1uZ07TlnMoiA6pz09JUQtsWqSgyDiT6Bh57Zy%2BJiDmJGsQZGotB27CMuOCUl1TI%2ByRXKVecx6lMv5PouLT0Voct%2BRjChIqxp3nUXluaXeRF3CG8xq%2Fu0XXOT72NOzeqQsqUDRspW7FxYhlPSfTZWYS1cPZWOY09KqtHQBU6dXf4cq0WNtXtS2q2OEHXn3owJLpx4dbe%2BsMpgP%2BHN%2FvD%2BzIOFtWm6nzL5F1YkAdSV5sLv0fPhzQi%2BNUFqVcXiwo0kzNUPCU5TT5SwbQ5IVtSv%2FoOkAU%2FY6jY3lhXN0tDc4yunB%2F1GStJnGyT3tDTtqpg1P1wMMYDIvlP8rffi39%2B2uBXyortJHW1H9nd8uyy21gDL%2FVDacpCtrmhnEtBpdRAy06U1BQXgrdCJFmZVeyD5Pvwr5utfwM%3D&Signature=J51yHd62am8TKqyRm2XvZJW8Pxgn%2BTX6BYIPBjuyGRA0nWszfCBIjbhgmq8GKbcFbBeeQMSb7RC2logqQzutbLedMzBqhcQKErsDB0VUTmERaTIRbZ3m9p4NTmch6ZdOqQGnWhj6q77%2FP9w7%2Bz6n%2BYS6HVhgeMrRiRgJRGxViKWWefzR%2BVVKw2NYwp1vVzjIlfLzL6YvfRuDAJeBIPd%2BY6yw2vSJDNnmccxWW6iztSbqLSbXmBJDKXUtTkg8%2F2k5Ln%2BPzD7F8EyRNO00%2FlXi9k8lZ92780cHLyc6vgFeC3XPXqW%2B67vZ6Gm%2BPjIW1aVjI%2BwW36PH306Xsf4wHmyqmA%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1
Public Key
-----BEGIN CERTIFICATE-----
MIIC/DCCAeSgAwIBAgIQaAoxr4T2M4tIykuSJeo7ijANBgkqhkiG9w0BAQsFADA6
MTgwNgYDVQQDEy9BREZTIFNpZ25pbmcgLSBzZHBvZC0yazE2LTEuY3Nlei56b2hv
Y29ycGluLmNvbTAeFw0yMDA0MDUxMzUxMDZaFw00NTAzMzAxMzUxMDZaMDoxODA2
BgNVBAMTL0FERlMgU2lnbmluZyAtIHNkcG9kLTJrMTYtMS5jc2V6LnpvaG9jb3Jw
aW4uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwyT2jK553ZYY
rgZNiXYUu2BkghSnZeZe6oRQjWisR51t+qZInz+k+qYx9tX/35Z8fiPSmVtW2fyO
U3hAw44AVm3+MBj1v5EvLqNtlrW6GF2/768EbohTmZxdYGFdiFF7lHR3BEsfB4Vo
sncvFt4oKXLbVfmXPV5oE2VtHO7SQbYUQ1lscQ3mZFpS9wgINmYcYz2KUZusLImB
vdq5Fd9sYYvHmCGP6ASjetKAtvklg5XCbvajkTdk1bKZNLisGQiN3asjH7+03K+A
c1ueScM4P1iSqVo2T55qrValTPYo4DNHFBZkRW++d3eMqMzzd276w5kSdK80TS+f
zGlbwcxLKwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCLRx0anoYQdaC4S4hkpYA5
Je3soN8QtWXrVeHkpT7IwqfJa5suSl9GoQDrt2rYGzxpvyloaPsoB1xugiRguPjW
5ZlgqRQsy9AJfJVN5SHfzkxAZntD8JgbRzjj7UW20c8ZEItA2t5bagiCvFNvR+AW
2D/2aUOB3V8NlwYNDgmr+c6dKLzZ7KD9a9cXB1+x3PgldF5cya3y2P5PcRt+u1Rm
fS0H6SIzbkjzDSMkYsNihbIQEyvFZKiu3BoC9B89Y97yWajDX3eIdhSBJcTd1gWa
E4B9pGRMj78x0dwibj5AF6O1yEg6gF0RThMVrYJe6docTGMRX7wt2wPUzsrusBuH
-----END CERTIFICATE-----
As per SAML Binding standard 3.4.4.1 DEFLATE Encoding
Appended Query String
SAMLRequest=lZLbat0wEEV%2FxehdlizLlwjH9NBDwJAm0IQ%2B9CXI1pzGjS05GrmEfH19SSil4UBfh9nai6WpUI%2FDpK7dDzeHr%2FA8A4aoOV6SBylLo1uZ07TlnMoiA6pz09JUQtsWqSgyDiT6Bh57Zy%2BJiDmJGsQZGotB27CMuOCUl1TI%2ByRXKVecx6lMv5PouLT0Voct%2BRjChIqxp3nUXluaXeRF3CG8xq%2Fu0XXOT72NOzeqQsqUDRspW7FxYhlPSfTZWYS1cPZWOY09KqtHQBU6dXf4cq0WNtXtS2q2OEHXn3owJLpx4dbe%2BsMpgP%2BHN%2FvD%2BzIOFtWm6nzL5F1YkAdSV5sLv0fPhzQi%2BNUFqVcXiwo0kzNUPCU5TT5SwbQ5IVtSv%2FoOkAU%2FY6jY3lhXN0tDc4yunB%2F1GStJnGyT3tDTtqpg1P1wMMYDIvlP8rffi39%2B2uBXyortJHW1H9nd8uyy21gDL%2FVDacpCtrmhnEtBpdRAy06U1BQXgrdCJFmZVeyD5Pvwr5utfwM%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator2020-08-26T23:32:04.627+00:00 @kumaran J
Thank you for your post. When you say that you couldn't verify the logout request received from the ADFS server. Are you having issues with the logout redirect when using ADFS?Any additional details on what you're trying to accomplish would definitely be helpful.
Thank you for your time! -
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator
2020-08-28T16:21:34.193+00:00 @kumaran J
I just wanted to check in and see if you required additional assistance or if you were able to resolve this issue? -
kumaran J 1 Reputation point
2020-08-31T11:55:07.043+00:00 Yes, I am having the issue with the logout redirect when using ADFS.
-
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator
2020-08-31T20:52:56.743+00:00 @kumaran J
Thanks for your reply!When it comes to your specific issue - not being able to verify the logout request received from the ADFS server.
- Are you following specific documentation? If so, can you provide a link to what you're following?
- Are you receiving any specific error message when it come to the logout request?
- What're you trying to verify? Or how're you trying to verify the logout request?
- What have you done to try and resolve your issue?
- Can you provide some additional context so I can gain a better understanding of your issue?
Any additional information, documentation, or screenshots would be greatly appreciated!
Thank you for your time and patience throughout this issue. -
kumaran J 1 Reputation point
2020-09-01T08:34:17.71+00:00 Are you following specific documentation? If so, can you provide a link to what you're following?
http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf. (3.4.4.1 DEFLATE Encoding)Are you receiving any specific error message when it comes to the logout request?
Nope..!What're you trying to verify? Or how're you trying to verify the logout request?
Trying to verify the signature param. By constructing the query string as below. But the signature verification is getting failed.SAMLRequest=value&RelayState=value&SigAlg=value
-
kumaran J 1 Reputation point
2020-09-01T08:35:35.89+00:00 What have you done to try and resolve your issue?
Initially, I was done the URL encoding on each param. But later I read the document again and found that the **URL-encoding is not canonical; that is, there are multiple legal encodings for a given value. The relying party MUST therefore perform the verification step using the original URL-encoded values it received on the query string**. So I get value from the queryString to construct the Signature. But still, the verification is getting failed. -
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator
2020-09-01T22:47:20.98+00:00 @kumaran J
Thank you for the info! Can you confirm if you provided a logout endpoint?
https://myadfsserver.domain.net/adfs/ls/?wa=wsignout1.0If you did and are still having issues, we'd like to work more closely with you on this issue. Can you please email me the below information, so I can enable a one-time free support request for you, this way you can work with a support engineer and get this sorted out and mitigated.
Email: AzCommunity@microsoft.com
Subject: ATTN James Tran
Body:
Subscription ID
Link to this email threadIf you have any other questions, please let me know.
Thank you again for your time and patience throughout this issue. -
kumaran J 1 Reputation point
2020-09-02T06:22:51.127+00:00 @JamesTran-MSFT
The provided endpoint will be used when the request initiated from SP --> IDP, and that flow is working fine.
The problem is when the request initiated from IDP --> SP.Body:
Subscription ID
Link to this email threadWhat the Subscription ID I have to link in the Email thread.
-
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator
2020-09-02T16:39:38.483+00:00 @kumaran J
Sorry for the confusion, I meant to type 'Link to this Q&A thread'Email: AzCommunity@microsoft.com
Subject: ATTN James Tran
Body:
Subscription ID
Link to this Q&A threadYou can find the subscription ID under 'Subscriptions' within the Azure Portal.
With this info, I'll be able to enable a one-time free support request for you.
If you have any other questions, please let me know.
Thank you for your time. -
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator
2020-09-03T16:34:23.46+00:00 @kumaran J
I just wanted to check in and see if you had a chance to email- AzCommunity@microsoft.com with your SubscriptionID, so I can enable a one-time free support request for you. This way our support team can take a closer look into your issue and help drive it towards resolution.Please let me know if you have any other questions.
Thank you for your time and patience throughout this issue. -
kumaran J 1 Reputation point
2020-09-08T04:38:57.377+00:00 I have already sent an email with the required Subscription Id. Please check the same and do the needful.
-
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator
2020-09-08T17:38:33.21+00:00 @kumaran J
Thanks for the info! I responded to your email and sent steps for creating a support request.Please let me know if you have any questions or issues creating the support request.
Thank you for your time and patience throughout this issue.
Sign in to comment
Sign in to answer