title: PingFederate Single Log-Off: My IdP issues only one LogoutRequest
body: <p>Building off of @Scott T.'s <a href="https://stackoverflow.com/q/8234254/109941">answer</a>:</p>
  
  <blockquote>
    <p>...PingFederate (acting as an IdP) <strong>knows</strong> which SPs you have
    federated with in a given session. When the user kicks off SLO (from
    the example you gave - at the IdP - it could also be initiated from an
    SP) the users browser (assuming a Redirect or POST binding) is sent to
    each SP with a SAML LogoutRequest.</p>
  </blockquote>
  
  <p>When I request <code>https://[PingFederateInstance]/idp/startSLO.ping?PartnerSpId=[PartnerSpId]</code>, according to server.log, PingFederate issues only <strong>one</strong> LogoutRequest.</p>
  
  <pre><code>&lt;samlp:LogoutRequest Destination="https://[PingFederateServerInstance]:[PortNumber]/sp/SLO.saml2" NotOnOrAfter="2011-11-22T23:02:37.812Z" IssueInstant="2011-11-22T22:57:37.812Z" ID="NEDH4Khn4TvWsOwfAZxK_XiEc6f" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
    &lt;saml:Issuer&gt;XXX:IDP&lt;/saml:Issuer&gt;
    &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
      &lt;ds:SignedInfo&gt;
        &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
        &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
        &lt;ds:Reference URI="#NEDH4Khn4TvWsOwfAZxK_XiEc6f"&gt;
          &lt;ds:Transforms&gt;
            &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
            &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
          &lt;/ds:Transforms&gt;
          &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
          &lt;ds:DigestValue&gt;Hnec0X3qfYlE2Z9+ooujtD1HKQk=&lt;/ds:DigestValue&gt;
        &lt;/ds:Reference&gt;
      &lt;/ds:SignedInfo&gt;
      &lt;ds:SignatureValue&gt;L6wmw7RF82s8W2s4YSkwHpnQFo6tFRKUZ3pyK7JEl/7CZyJsxJ5lnfpdaaogm/Gl3S3Y7WoSjbp4
  ssaNjtQ3x/nHsYI0zill66yhQ/DNaXAdRuKw6jDi9vqXemkYGx9cNxLkLvc14CUdn9qRA0gZcjyj
  ncaZvvWL5Kzy9JOuWSg=&lt;/ds:SignatureValue&gt;
    &lt;/ds:Signature&gt;
    &lt;saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"&gt;10072824&lt;/saml:NameID&gt;
    &lt;samlp:SessionIndex&gt;dWh6bd58GRgnbLgeYsTWSVXT7pO&lt;/samlp:SessionIndex&gt;
  &lt;/samlp:LogoutRequest&gt;
  </code></pre>
  
  <hr>
  
  <p>My Question:</p>
  
  <ul>
  <li>If I've federated with more than one SP, how should I configure PingFederate so that it issues one request per federated SP?</li>
  </ul>
  
  <p>I'm inclined to believe that:</p>
  
  <ol>
  <li>I need to configure something on <a href="http://documentation.pingidentity.com/download/attachments/7212296/SP_Configuration.07.51.1.jpg?version=1&amp;modificationDate=1314911071707" rel="nofollow noreferrer">this screen</a>.</li>
  <li>In agreement with the idea that the multiple SP logout requests are "chained together", the last endpoint URL should be /idp/SLO.saml2.</li>
  </ol>