How to implement SAML logout to ADFS with openSaml? - single-sign-on

Question

I created Logout Request using openSaml library and added signature
<samlp:LogoutRequest ID="_f576971e-5123-49e4-8152-80653dcdfb1a"
IssueInstant="2015-07-23T15:21:42.254Z"
Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<samlp:Issuer xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion">https://my_host/logout</samlp:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_f576971e-5123-49e4-8152-80653dcdfb1a">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue/>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue/>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIC...</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">_933c8876-9128-431f-b250-08975fde2a24</saml2:NameID>
<saml2p:SessionIndex xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">8ee4bf85-6792-42f5-b038-a3342a0e0e17</saml2p:SessionIndex>
</samlp:LogoutRequest>
And I encoded this and sended to ADFS-server like URL:
https://ADFS_HOST/adfs/ls/SignOut.aspx?SAMLRequest=nVbbk...
But, I got an error from ADFS:
The Federation Service encountered an error while processing the SAML
authentication request.
Additional Data Exception details: System.Xml.XmlException:
MSIS0018: The SAML protocol message cannot be read because it contains
data that is not valid. ---> System.InvalidOperationException: No
corresponding start element is open. at
System.Xml.XmlBaseReader.ReadEndElement() at
Microsoft.IdentityModel.Protocols.XmlSignature.SignedInfo.ReadFrom(XmlDictionaryReader
reader, TransformFactory transformFactory) at
Microsoft.IdentityModel.Protocols.XmlSignature.Signature.ReadFrom(XmlDictionaryReader
reader) at
Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.ReadSignature()
at
Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.TryReadSignature()
at
Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommonElements(XmlReader
reader, SamlMessage message) --- End of inner exception stack trace
--- at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommonElements(XmlReader
reader, SamlMessage message) at
Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadLogoutRequest(XmlReader
reader) at
Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadSamlMessage(XmlReader
reader, NamespaceContext context) at
Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.ReadProtocolMessage(String
encodedSamlMessage) at
Microsoft.IdentityServer.Protocols.Saml.Contract.SamlContractUtility.CreateSamlMessage(MSISSamlBindingMessage
message) at
Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.Logout(HttpSamlMessage
logoutMessage, String sessionState, String logoutState, Boolean
partialLogout, Boolean isUrlTranslationNeeded, HttpSamlMessage&
newLogoutMessage, String& newSessionState, String& newLogoutState,
Boolean& validLogoutRequest)
And I can't find some information about this problems.
Any ideas?

Answer 1

6.3.0.0 is ADFS on S2012R2 :-). I needed that to take a look in the executable. I didn't want to look in the wrong server. The exception says that there is something wrong with the signature. So true: the digest and signature values are missing.
No offense just a warning. It looks a bit as if you are trying to write this yourself. If so then do realize that it is a really serious amount of work. And requires major maintenance effort. And signatures is probably the trickiest part, steer away from that course if you can. Think in months of learning+work....
At first glimpse there seem to be other issues with the request. But discussing them is really a lot of work.... I suggest you do take at least a look at the XML of another implementation. One that comes of the shelve (Kantara certified even better). And make sure you have the same attributes and elements.