ITfoxtec Identity SAML 2.0 - Signed LogoutRequest Failing - itfoxtec-identity-saml2

Question

Our signed LogoutRequest is failing:
The response page contains:
Charles Sturt University.
Gateway to Charles Sturt University - Message Security Error.
The request cannot be fulfilled because the message received does not meet the security requirements of the login service.
Firefox SAML-tracer HTTP is:
GET https://idpqa.csu.edu.au/idp/profile/SAML2/Redirect/SLO?SAMLRequest=... HTTP/1.1
Host: idpqa.csu.edu.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fmcentralqa.csu.edu.au/
Connection: keep-alive
Cookie: JSESSIONID=...; shib_idp_session=...; _ga=GA1.3.431747786.1588552072; monsido=31C1664470149254; _ga_09603PQVTC=GS1.1.1664587069.2.1.1664587158.0.0.0; _ga_JDV9LDRK2K=GS1.1.1664587069.2.1.1664587158.0.0.0; _ce.s=v~f561c11e21992291df080494673e8fe0dd976c1a~vpv~3; _gid=GA1.3.876195772.1664587070; lb-idp-session=...; _gat_UA-323552-1=1; cebs=1; cebsp=1; _gat_gtag_UA_323552_1=1; _gat=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sec-Fetch-User: ?1
HTTP/1.1 400 400
Date: Sat, 01 Oct 2022 01:19:30 GMT
Server: Apache
Cache-Control: no-store
Content-Type: text/html;charset=utf-8
Content-Length: 1129
Connection: close
Firefox SAML-tracer Parameters is:
GET
SAMLRequest: ...
Firefox SAML-tracer SAML is:
<saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_4dac685e-fa5b-4f14-beb5-eb3e1bbebe46"
Version="2.0"
IssueInstant="2022-10-01T01:19:30.761Z"
Destination="https://idpqa.csu.edu.au/idp/profile/SAML2/Redirect/SLO"
NotOnOrAfter="2022-10-01T01:29:30.761Z"
>
<saml2:Issuer>https://fmcentralqa.csu.edu.au/sisfm-enquiry</saml2:Issuer>
<saml2:NameID>pwijaya</saml2:NameID>
<saml2p:SessionIndex>oeft2tbnpv1u33hmtwwx42ig</saml2p:SessionIndex>
</saml2p:LogoutRequest>
Our logout.aspx page contains:
Sub SAMLLogoutSISfm()
Dim settings = ConfigurationManager.AppSettings
Dim config As Saml2Configuration = New Saml2Configuration() With
{
.AllowedIssuer = settings("SamlIdpSettings:entityid"),
.SingleSignOnDestination = New System.Uri(settings("SamlIdpSettings:loginurl")),
.SingleLogoutDestination = New System.Uri(settings("SamlIdpSettings:logouturl"))
}
'changed Core MVC AppEnvironment.MapToPhysicalFilePath to HttpContext.Current.Server.MapPath
config.SigningCertificate = ITfoxtec.Identity.Saml2.Util.CertificateUtil.Load(HttpContext.Current.Server.MapPath(settings("SamlIdpSettings:SigningCertificateFile")), settings("SamlIdpSettings:SigningCertificatePassword"), X509KeyStorageFlags.MachineKeySet Or X509KeyStorageFlags.PersistKeySet)
Dim redirectUrl As String = SamlLogoutTest(sessionIndex, nameId)
Response.write("here" + redirecturl + "<br/>")
Response.Redirect(redirectUrl)
End Sub
Function SamlLogoutTest(ByVal sessionIndex As String, ByVal nameId As String) As String
Try
Dim settings = ConfigurationManager.AppSettings
Dim binding = New Saml2RedirectBinding()
Dim config = New Saml2Configuration() With {.SignAuthnRequest = True}
Dim redirBind = binding.Bind(New Saml2LogoutRequest(config) With
{
.SessionIndex = sessionIndex,
.NameId = New System.IdentityModel.Tokens.Saml2NameIdentifier(nameId),
.Issuer = settings("SamlSpSettings:entityid"),
.Destination = New System.Uri(settings("SamlIdpSettings:logouturl"))
})
Return redirBind.RedirectLocation.ToString()
Catch ex As Exception
Return Nothing
End Try
End Function
Our web.config contains:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<appSettings>
<add key="SamlSpSettings:entityid" value="https://fmcentralqa.csu.edu.au/sisfm-enquiry" />
<add key="SamlIdpSettings:entityid" value="https://idpqa.csu.edu.au/idp/shibboleth" />
<add key="SamlIdpSettings:loginurl" value="https://idpqa.csu.edu.au/idp/profile/SAML2/Redirect/SSO" />
<add key="SamlIdpSettings:logouturl" value="https://idpqa.csu.edu.au/idp/profile/SAML2/Redirect/SLO" />
<add key="SamlIdpSettings:SigningCertificateFile" value="/SISfm-Enquiry/CSU/FmcentralQa3.pfx" />
<add key="SamlIdpSettings:SigningCertificatePassword" value="cadcorp" />
<!-- more -->
</appSettings>
</configuration>
How can we resolve this issue?

Answer 1

The logout request is default signed if a signing certificate with a private key is provided. Maybe your .NET code is not able to load the private part of the certificate.
Please take a look the ASP.NET RP sample.