title: How to implement SAML logout to ADFS with openSaml?
body: <p>I created Logout Request using openSaml library and added signature</p>
  
  <pre><code>&lt;samlp:LogoutRequest ID="_f576971e-5123-49e4-8152-80653dcdfb1a"
      IssueInstant="2015-07-23T15:21:42.254Z"
      Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;samlp:Issuer xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion"&gt;https://my_host/logout&lt;/samlp:Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
              &lt;ds:Reference URI="#_f576971e-5123-49e4-8152-80653dcdfb1a"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                  &lt;ds:DigestValue/&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue/&gt;
          &lt;ds:KeyInfo&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;MIIC...&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;saml2:NameID
          Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;_933c8876-9128-431f-b250-08975fde2a24&lt;/saml2:NameID&gt;
      &lt;saml2p:SessionIndex xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"&gt;8ee4bf85-6792-42f5-b038-a3342a0e0e17&lt;/saml2p:SessionIndex&gt;
  &lt;/samlp:LogoutRequest&gt;
  </code></pre>
  
  <p>And I encoded this and sended to ADFS-server like URL:</p>
  
  <p><a href="https://ADFS_HOST/adfs/ls/SignOut.aspx?SAMLRequest=nVbbk" rel="nofollow">https://ADFS_HOST/adfs/ls/SignOut.aspx?SAMLRequest=nVbbk</a>...</p>
  
  <p>But, I got an error from ADFS: </p>
  
  <blockquote>
    <p>The Federation Service encountered an error while processing the SAML
    authentication request. </p>
    
    <p>Additional Data  Exception details:  System.Xml.XmlException:
    MSIS0018: The SAML protocol message cannot be read because it contains
    data that is not valid. ---> System.InvalidOperationException: No
    corresponding start element is open.    at
    System.Xml.XmlBaseReader.ReadEndElement()    at
    Microsoft.IdentityModel.Protocols.XmlSignature.SignedInfo.ReadFrom(XmlDictionaryReader
    reader, TransformFactory transformFactory)    at
    Microsoft.IdentityModel.Protocols.XmlSignature.Signature.ReadFrom(XmlDictionaryReader
    reader)    at
    Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.ReadSignature()
    at
    Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.TryReadSignature()
    at
    Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommonElements(XmlReader
    reader, SamlMessage message)    --- End of inner exception stack trace
    ---    at Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadCommonElements(XmlReader
    reader, SamlMessage message)    at
    Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadLogoutRequest(XmlReader
    reader)    at
    Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSerializer.ReadSamlMessage(XmlReader
    reader, NamespaceContext context)    at
    Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.ReadProtocolMessage(String
    encodedSamlMessage)    at
    Microsoft.IdentityServer.Protocols.Saml.Contract.SamlContractUtility.CreateSamlMessage(MSISSamlBindingMessage
    message)    at
    Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.Logout(HttpSamlMessage
    logoutMessage, String sessionState, String logoutState, Boolean
    partialLogout, Boolean isUrlTranslationNeeded, HttpSamlMessage&amp;
    newLogoutMessage, String&amp; newSessionState, String&amp; newLogoutState,
    Boolean&amp; validLogoutRequest)</p>
  </blockquote>
  
  <p>And I can't find some information about this problems.</p>
  
  <p>Any ideas?</p>