SAML 2.0 LogoutRequest

Question

I am working on handling LogOutRequest from a replying party on the STS side. I can parse LogoutRequest, delete the cookie and generate a LogoutResponse. The problem is where to send the LogoutResponse, I did not find the information about reply url. Any ideas?

Answer 1

SingleLogoutService information is defined as part of the SAML 2.0 metadata that partners would exchange during setup. That would tell you where the Single Logout handlers are, and for which binding. I don't believe this information is typically populated in the logout request messages themselves.