Setting to accept unsigned Logout messages

[lindea]

Hi!

I have a problem with the single signout functionality.
I'm using AS.Owin 1.7.2 on a site with multiple domains (actually it's several sites in same application).
I create SP for all domains dynamically like this:

foreach(var domain in domains){
 app.UseKentorAuthServicesAuthentication(CreateAuthServicesOptions("kentor", domain.Name));
}

This works fine for login, and the login request is called with the right metadata based on the domain.
For the logout request the issuer is always from the first domain, and thus fails.
Each SP has it's own unique module path.

For the logout I use
OwinContext.Authentication.SignOut(DefaultAuthenticationTypes.ApplicationCookie, DefaultAuthenticationTypes.ExternalCookie);

This doesn't seem to trigger single sign out, so I redirect to /logout where the signout request is triggered.

Any suggestions?

[AndersAbel]

You need to include AuthServices in the sign out types. Either sign out of everything by calling OwinContext.Authentication.SignOut() or include the signin-type of the AuthServices instance that you want to sign out of.

[lindea]

Thank you for The super fast response!
I was able to trigger signout by specifying the AuthenticationType as you suggested. The problem now is that the respons is required to be signed, which it's not. Is there an option to turn off that requirement?

[AndersAbel]

There's no option to turn of the signing requirement for logout messages. It's part of the profile spec section 4.4.4.2:

The responder MUST authenticate itself to the requester and ensure message integrity, either by signing the message or using a binding-specific mechanism.

But if you really need an option to switch it off, I can consider adding it.

[lindea]

Thanks again. I'll have a talk with the idp-guys first and hear what they have to say.

[lindea]

Hi again!
I've talked to the Idp, and they do not provide signed logout response despite the requirements. They might do in the future though. It would be nice to be able to choose whether or not to accept unsigned logon responses, so I'll be grateful if you would consider implementing this.

[AndersAbel]

I see the need for it, but as this is very non-standard it's far down on the priority list for free-time development. If you want to sponsor the development to get it done faster, please drop me a mail.