SES-175: Single Logout Response is never signed

[spring-projects-issues]

John Chan (Migrated from SES-175) said:

Regardless of the setting when , the LogoutResponse is never signed.

This is because line 242 in org.springframework.security.saml.websso.SingleLogoutProfileImpl.java
boolean signMessage = context.getPeerExtendedMetadata().isRequireLogoutResponseSigned() is always false.

By SAML standards, I believe this should always be true but if I interpret the intent correctly, this should be changed to:
boolean signMessage = context.getLocalExtendedMetadata().isRequireLogoutResponseSigned()

It seems that some IdPs don't enforce the signing (OpenAM for instance). However, Ping Federate does.

[MikeN123]

You'll want to set the extended metadata for your IdP, something like this should work:

        <property name="extendedMetadata">
            <bean class="org.springframework.security.saml.metadata.ExtendedMetadata">
                <property name="requireLogoutResponseSigned" value="true" />
            </bean>
        </property>