title: Spring Saml single logout(Gloabal) with okta not sending saml logout request
body: <p>I am new to okta,saml. Single Sign on integration is successfull and now I want to do Single logout. I have done the following in Okta-</p>
  
  <p>1) Single Logout url: <a href="http://localhost:8080/spring-security-saml2-sample/saml/logout" rel="nofollow noreferrer">http://localhost:8080/spring-security-saml2-sample/saml/logout</a></p>
  
  <p>2) SP Issuer : <a href="http://localhost:8080/spring-security-saml2-sample/saml/metadata" rel="nofollow noreferrer">http://localhost:8080/spring-security-saml2-sample/saml/metadata</a></p>
  
  <p>3) Created certificate and uploaded.</p>
  
  <p>In my SecurityConfig defined filters as follows.</p>
  
  <pre><code>&lt;bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;security:filter-chain-map request-matcher="ant"&gt;
          &lt;security:filter-chain pattern="/saml/metadata/**" filters="metadataDisplayFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/&gt;
          &lt;security:filter-chain pattern="/saml/logout/**" filters="samlLogoutFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSOHoK/**" filters="samlWebSSOHoKProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/discovery/**" filters="samlIDPDiscovery"/&gt;
      &lt;/security:filter-chain-map&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>Now from my apps log out button invoking <a href="http://localhost:8080/spring-security-saml2-sample/saml/logout" rel="nofollow noreferrer">http://localhost:8080/spring-security-saml2-sample/saml/logout</a>, works fine. But it is a local logout. I want to do a Gloabal Logout.
  So that I changed the filter as follows-</p>
  
  <pre><code>&lt;bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy"&gt;
  &lt;security:filter-chain-map request-matcher="ant"&gt;
      &lt;security:filter-chain pattern="/saml/metadata/**" filters="metadataDisplayFilter"/&gt;
      &lt;security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/&gt;
      &lt;security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/&gt;
      &lt;security:filter-chain pattern="/saml/SSOHoK/**" filters="samlWebSSOHoKProcessingFilter"/&gt;
      &lt;security:filter-chain pattern="/saml/logout/**" filters="samlLogoutProcessingFilter"/&gt;
      &lt;security:filter-chain pattern="/saml/discovery/**" filters="samlIDPDiscovery"/&gt;
  &lt;/security:filter-chain-map&gt;
  </code></pre>
  
  <p>
  But its not working, shows “404 Not found”, and its not sending Saml logout request. How can I fix this issue. I want to do a gloabal log out. Thanks in advance.
  Here is my SecurityConfig.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:security="http://www.springframework.org/schema/security"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns:context="http://www.springframework.org/schema/context"
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
            http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd"&gt;
  
  &lt;!-- Enable auto-wiring --&gt;
  &lt;context:annotation-config/&gt;
  
  &lt;!-- Scan for auto-wiring classes in spring saml packages --&gt;
  &lt;context:component-scan base-package="org.springframework.security.saml"/&gt;
  
  
  &lt;!-- Unsecured pages --&gt;
  &lt;!--
  &lt;security:http security="none" pattern="/favicon.ico"/&gt;
  &lt;security:http security="none" pattern="/images/**"/&gt;
  &lt;security:http security="none" pattern="/css/**"/&gt;
  &lt;security:http security="none" pattern="/logout.jsp"/&gt;
  --&gt;
  
  &lt;!-- Security for the administration UI --&gt;
  &lt;!--&lt;security:http pattern="/saml/web/**" use-expressions="false"&gt;
      &lt;security:access-denied-handler error-page="/saml/web/metadata/login"/&gt;
      &lt;security:form-login login-processing-url="/saml/web/login" login-page="/saml/web/metadata/login" default-target-url="/saml/web/metadata"/&gt;
      &lt;security:intercept-url pattern="/saml/web/metadata/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
      &lt;security:intercept-url pattern="/saml/web/**" access="ROLE_ADMIN"/&gt;
      &lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
  &lt;/security:http&gt; --&gt;
  
  &lt;!-- Secured pages with SAML as entry point --&gt;
  &lt;security:http entry-point-ref="samlEntryPoint" use-expressions="false"&gt;
      &lt;security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/&gt;
      &lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
      &lt;security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/&gt;
  &lt;/security:http&gt;
  
  &lt;!-- Filters for processing of SAML messages --&gt;
  &lt;bean id="samlFilter" 
    class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;security:filter-chain-map request-matcher="ant"&gt;
          &lt;security:filter-chain pattern="/saml/metadata/**" 
  filters="metadataDisplayFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/login/**" 
  filters="samlEntryPoint"/&gt;
  &lt;!--             &lt;security:filter-chain pattern="/saml/logout/**" 
  filters="samlLogoutFilter"/&gt; --&gt;
          &lt;security:filter-chain pattern="/saml/logout/**" 
  filters="samlLogoutProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSO/**" 
  filters="samlWebSSOProcessingFilter"/&gt;
            &lt;security:filter-chain pattern="/saml/SSOHoK/**" 
  filters="samlWebSSOHoKProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/discovery/**" 
  filters="samlIDPDiscovery"/&gt;
      &lt;/security:filter-chain-map&gt;
  &lt;/bean&gt;
  
  &lt;!-- Handler deciding where to redirect user after successful login --&gt;
  &lt;bean id="successRedirectHandler"
        class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/"/&gt;
  &lt;/bean&gt;
  &lt;!--
  Use the following for interpreting RelayState coming from unsolicited response as redirect URL:
  &lt;bean id="successRedirectHandler" class="org.springframework.security.saml.SAMLRelayStateSuccessHandler"&gt;
     &lt;property name="defaultTargetUrl" value="/" /&gt;
  &lt;/bean&gt;
  --&gt;
  
  &lt;!-- Handler deciding where to redirect user after failed login --&gt;
  &lt;bean id="failureRedirectHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"&gt;
      &lt;property name="useForward" value="true"/&gt;
      &lt;property name="defaultFailureUrl" value="/error.jsp"/&gt;
  &lt;/bean&gt;
  
  
  &lt;!-- Handler for successful logout --&gt;
  &lt;bean id="successLogoutHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/logout.jsp"/&gt;
  &lt;/bean&gt;
  
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;!-- Register authentication manager for SAML provider --&gt;
      &lt;security:authentication-provider ref="samlAuthenticationProvider"/&gt;
      &lt;!-- Register authentication manager for administration UI --&gt; 
      &lt;security:authentication-provider&gt;
          &lt;security:user-service id="adminInterfaceService"&gt;
              &lt;security:user name="admin" password="admin" authorities="ROLE_ADMIN"/&gt;
          &lt;/security:user-service&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt; 
  
  &lt;!-- Logger for SAML messages and events --&gt;
  &lt;bean id="samlLogger" class="org.springframework.security.saml.log.SAMLDefaultLogger"/&gt;
  
  &lt;!-- Central storage of cryptographic keys --&gt;
  &lt;bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager"&gt;
      &lt;constructor-arg value="classpath:security/samlKeystore.jks"/&gt;
      &lt;constructor-arg type="java.lang.String" value="nalle123"/&gt;
      &lt;constructor-arg&gt;
          &lt;map&gt;
              &lt;entry key="apollo" value="nalle123"/&gt;
          &lt;/map&gt;
      &lt;/constructor-arg&gt;
      &lt;constructor-arg type="java.lang.String" value="apollo"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Entry point to initialize authentication, default values taken from properties file --&gt;
  &lt;bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint"&gt;
      &lt;property name="defaultProfileOptions"&gt;
          &lt;bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"&gt;
              &lt;property name="includeScoping" value="false"/&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;!-- IDP Discovery Service --&gt;
  &lt;bean id="samlIDPDiscovery" 
  class="org.springframework.security.saml.SAMLDiscovery"&gt;
  &lt;!--         &lt;property name="idpSelectionPath" value="/idpSelection.jsp"/&gt; -
  -&gt;
  &lt;/bean&gt;
  
  &lt;!-- Filter automatically generates default SP metadata --&gt;
  &lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
              &lt;property name="extendedMetadata"&gt;
                  &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                      &lt;property name="idpDiscoveryEnabled" value="false"/&gt;
                  &lt;/bean&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;!-- The filter is waiting for connections on URL suffixed with filterSuffix and presents SP metadata there --&gt;
  &lt;bean id="metadataDisplayFilter" class="org.springframework.security.saml.metadata.MetadataDisplayFilter"/&gt;
  
  &lt;!-- Configure HTTP Client to accept certificates from the keystore for HTTPS verification --&gt;
  &lt;!--
  &lt;bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolConfigurer"&gt;
      &lt;property name="sslHostnameVerification" value="default"/&gt;
  &lt;/bean&gt;
  --&gt;
  
  &lt;!-- IDP Metadata configuration - paths to metadata of IDPs in circle of trust is here --&gt;
  &lt;bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"&gt;
             &lt;!-- &lt;property name="defaultIDP" value="https://nshobayo.oktapreview.com/"/&gt; --&gt;
  
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;!-- Example of file system metadata without Extended Metadata --&gt;
              &lt;!--
              &lt;bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"&gt;
                  &lt;constructor-arg&gt;
                      &lt;value type="java.io.File"&gt;/usr/local/metadata/idp.xml&lt;/value&gt;
                  &lt;/constructor-arg&gt;
                  &lt;property name="parserPool" ref="parserPool"/&gt;
              &lt;/bean&gt;
              --&gt;
              &lt;bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider"&gt;
                &lt;!-- URL containing the metadata --&gt;
                &lt;constructor-arg&gt;
                  &lt;!-- This URL should look something like this: https://{yourOktaDomain}.com/app/abc0defghijK1lmN23o4/sso/saml/metadata --&gt;
                  &lt;value type="java.lang.String"&gt;{{MyMetadataUrl}}&lt;/value&gt;
                &lt;/constructor-arg&gt;
                &lt;!-- Timeout for metadata loading in ms --&gt;
                &lt;constructor-arg&gt;
                  &lt;value type="int"&gt;5000&lt;/value&gt;
                &lt;/constructor-arg&gt;
                &lt;property name="parserPool" ref="parserPool"/&gt;
              &lt;/bean&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
      &lt;!-- OPTIONAL used when one of the metadata files contains information about this service provider --&gt;
      &lt;!-- &lt;property name="hostedSPName" value=""/&gt; --&gt;
      &lt;!-- OPTIONAL property: can tell the system which IDP should be used for authenticating user by default. --&gt;
  &lt;/bean&gt;
  
  &lt;!-- SAML Authentication Provider responsible for validating of received SAML messages --&gt;
  &lt;bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider"&gt;
      &lt;!-- OPTIONAL property: can be used to store/load user data after login --&gt;
      &lt;!--
      &lt;property name="userDetails" ref="bean" /&gt;
      --&gt;
  &lt;/bean&gt;
  
  &lt;!-- Provider of default SAML Context --&gt;
  &lt;bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl"/&gt;
  
  &lt;!-- Processing filter for WebSSO profile messages --&gt;
  &lt;bean id="samlWebSSOProcessingFilter" class="org.springframework.security.saml.SAMLProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationSuccessHandler" ref="successRedirectHandler"/&gt;
      &lt;property name="authenticationFailureHandler" ref="failureRedirectHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Processing filter for WebSSO Holder-of-Key profile --&gt;
  &lt;bean id="samlWebSSOHoKProcessingFilter" class="org.springframework.security.saml.SAMLWebSSOHoKProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationSuccessHandler" ref="successRedirectHandler"/&gt;
      &lt;property name="authenticationFailureHandler" ref="failureRedirectHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Logout handler terminating local session --&gt;
  &lt;bean id="logoutHandler"
        class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"&gt;
      &lt;property name="invalidateHttpSession" value="true"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Override default logout processing filter with the one processing SAML messages --&gt;
  &lt;bean id="samlLogoutFilter" class="org.springframework.security.saml.SAMLLogoutFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
      &lt;constructor-arg index="2" ref="logoutHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Filter processing incoming logout messages --&gt;
  &lt;!-- First argument determines URL user will be redirected to after successful global logout --&gt;
  &lt;bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.SAMLLogoutProcessingFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Class loading incoming SAML messages from httpRequest stream --&gt;
  &lt;bean id="processor" class="org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;ref bean="redirectBinding"/&gt;
              &lt;ref bean="postBinding"/&gt;
              &lt;ref bean="artifactBinding"/&gt;
              &lt;ref bean="soapBinding"/&gt;
              &lt;ref bean="paosBinding"/&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;!-- SAML 2.0 WebSSO Assertion Consumer --&gt;
  &lt;bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/&gt;
  
  &lt;!-- SAML 2.0 Holder-of-Key WebSSO Assertion Consumer --&gt;
  &lt;bean id="hokWebSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  
  &lt;!-- SAML 2.0 Web SSO profile --&gt;
  &lt;bean id="webSSOprofile" class="org.springframework.security.saml.websso.WebSSOProfileImpl"/&gt;
  
  &lt;!-- SAML 2.0 Holder-of-Key Web SSO profile --&gt;
  &lt;bean id="hokWebSSOProfile" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  
  &lt;!-- SAML 2.0 ECP profile --&gt;
  &lt;bean id="ecpprofile" class="org.springframework.security.saml.websso.WebSSOProfileECPImpl"/&gt;
  
  &lt;!-- SAML 2.0 Logout Profile --&gt;
  &lt;bean id="logoutprofile" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl"/&gt;
  
  &lt;!-- Bindings, encoders and decoders used for creating and parsing messages --&gt;
  &lt;bean id="postBinding" class="org.springframework.security.saml.processor.HTTPPostBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="redirectBinding" class="org.springframework.security.saml.processor.HTTPRedirectDeflateBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="artifactBinding" class="org.springframework.security.saml.processor.HTTPArtifactBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.saml.websso.ArtifactResolutionProfileImpl"&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="org.apache.commons.httpclient.HttpClient"&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class="org.apache.commons.httpclient.MultiThreadedHttpConnectionManager"/&gt;
                      &lt;/constructor-arg&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
              &lt;property name="processor"&gt;
                  &lt;bean class="org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
                      &lt;constructor-arg ref="soapBinding"/&gt;
                  &lt;/bean&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="soapBinding" class="org.springframework.security.saml.processor.HTTPSOAP11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="paosBinding" class="org.springframework.security.saml.processor.HTTPPAOS11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Initialization of OpenSAML library--&gt;
  &lt;bean class="org.springframework.security.saml.SAMLBootstrap"/&gt;
  
  &lt;!-- Initialization of the velocity engine --&gt;
  &lt;bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/&gt;
  
  &lt;!-- XML parser pool needed for OpenSAML parsing --&gt;
  &lt;bean id="parserPool" class="org.opensaml.xml.parse.StaticBasicParserPool" init-method="initialize"&gt;
      &lt;property name="builderFeatures"&gt;
          &lt;map&gt;
              &lt;entry key="http://apache.org/xml/features/dom/defer-node-expansion" value="false"/&gt;
          &lt;/map&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="parserPoolHolder" class="org.springframework.security.saml.parser.ParserPoolHolder"/&gt;
  
  &lt;/beans&gt;
  </code></pre>