We have now implemented your excellent Identity Saml2 package for several of our customers.
However, one of our customers has written to us as follows:
LogoutRequests need to be signed (mandatory), and I need to add the certificate you are signing with into the metadata to verify that it was [your application] that signed it.
The same certificate is also used for signing the AuthnRequest (but that is optional but preferred)
We do not know what to do about this. Any advice will be greatly appreciated.
In case it helps, following is in our application web.config for this customer:
<add key="SamlSpSettings:entityid" value="https://fmcentralqa.csu.edu.au/sisfm-enquiry" />
<add key="SamlSpSettings:acs" value="https://fmcentralqa.csu.edu.au/SISfm-Enquiry/CSU/saml.aspx" />
<add key="SamlIdpSettings:entityid" value="https://idpqa.csu.edu.au/idp/shibboleth" />
<add key="SamlIdpSettings:loginurl" value="https://idpqa.csu.edu.au/idp/profile/SAML2/Redirect/SSO" />
<add key="SamlIdpSettings:logouturl" value="https://idpqa.csu.edu.au/idp/profile/SAML2/Redirect/SLO" />
<add key="SamlIdpSettings:signercert1" value="...................." />
<add key="SamlIdpSettings:saml2sessionindex" value="http://schemas.itfoxtec.com/ws/2014/02/identity/claims/saml2sessionindex" />
<add key="SamlIdpSettings:saml2nameidformat" value="http://schemas.itfoxtec.com/ws/2014/02/identity/claims/saml2nameidformat" />
<add key="SamlIdpSettings:uid" value="urn:oid:0.9.2342.19200300.100.1.1" />
<add key="SamlIdpSettings:emailaddress" value="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
<add key="SamlIdpSettings:name" value="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
<add key="SamlIdpSettings:givenname" value="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
<add key="SamlIdpSettings:surname" value="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" />
<add key="SamlIdpSettings:groups" value="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" />
Thank you.