SA-38454

Summary

Logout from SAML is failing after a change at IDP side. Developer started using SHA256 instead of SHA1 for signature method. The login is working fine.

Error Messages

java.security.SignatureException: Signature encoding error

followed with:

java.io.IOException: ObjectIdentifier mismatch: <1.2.3.4>

Steps to Reproduce

1. Login using sso url.
2. Click Logout.

Root Cause

The "Logout (SLO) protocol binding" for IDP auth was using "HTTP Redirect" after moving to SHA256 at IDP.

Resolution

In case of SHA-256 signature encoding at IDP, for SLO it is mandatory to use only SOAP binding for "Logout (SLO) protocol binding" in the IDP auth of the SAML configuration.