Support Article

SAML: Logout failure

SA-38454

Summary



Logout from SAML is failing after a change at IDP side. Developer started using SHA256 instead of SHA1 for signature method. The login is working fine.


Error Messages



java.security.SignatureException: Signature encoding error

followed with:

java.io.IOException: ObjectIdentifier mismatch: <1.2.3.4>

Steps to Reproduce

  1. Login using sso url.
  2. Click Logout.

Root Cause



The "Logout (SLO) protocol binding" for IDP auth was using "HTTP Redirect" after moving to SHA256 at IDP.

Resolution

In case of SHA-256 signature encoding at IDP, for SLO it is mandatory to use only SOAP binding for "Logout (SLO) protocol binding" in the IDP auth of the SAML configuration.

Published May 24, 2017 - Updated June 9, 2017

Have a question? Get answers now.

Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.