Symptom
- After logout from an application using Identity Authentication as a proxy, the user is receiving "HTTP 400 - Identity Provider could not process the logout message received" UI error, instead of the session logout and redirect to the landing page.
- Identity Authentication Troubleshooting log is showing the below error:Identity Provider could not process SAML2 logout message. Error during sending LogoutRequest to Service Provider Caused by: There is no configured SLO endpoint for trusted Identity Provider
- The SAML trace might show <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed" /> in LogoutResponse. Since the logout from the corporate IdP is not with status Success, at Identity Authentication side is returned partial logout to the application: <StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:PartialLogout" />
Read more...
Environment
Identity Authentication
Product
Identity Authentication 1.0
Keywords
IAS, SLO, 400, error, partial, logout, corporate, idp, Identity Provider could not process the logout message received, SLO endpoint , KBA , BC-IAM-IDS , Identity Authentication Service , Problem
About this page
This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).Search for additional results
Visit SAP Support Portal's SAP Notes and KBA Search.
SAP Knowledge Base Article - Preview