Support for embedded signatures in LogoutRequest

[sbc100]

As far as I can tell there is no support for embedded signature.

In the ruby-saml library there is an embed_sign option that does this.

[pitbulk]

There is no official support for embedded signatures on LogoutRequest used by HTTP-POST binding at this toolkit.

You can extend the classes on the toolkit and implement it using the add_sign method on the generated Logoutrequest retrieved from the get_request and executing a POST instead a redirect.

Related threads: #146 and #78

[sbc100]

Thanks for the response. I will try using add_sign to implement this.

As you you saying the embedding signatures is related to the POST vs redirect? From my brief inspection of ruby-saml it looks like embed_sign can be used with either redirect or POST. i.e. are you sure these two choices are not orthogonal?

In my particular case I'm trying to write a python SP that talks to an IdP based on https://github.com/sportngin/saml_idp which seems to require embedded signatures even when logout is sent via redirect.

[pitbulk]

When using the Redirect binding you put the signature in the URL query parameters

3.4.4.1 DEFLATE Encoding

SAML protocol messages can be encoded into a URL via the DEFLATE compression method 
(see[RFC1951]). In such an encoding, the following procedure should be applied to the original SAML protocol message's XML serialization:
1.
Any signature on the SAML protocol message, including the <ds:Signature> XML element itself,
MUST be removed. Note that if the content of the message includes another signature, such as a
signed SAML assertion, this embedded signature is not removed. However, the length of such a
message after encoding essentially precludes using this mechanism. Thus SAML protocol messages that contain signed content SHOULD NOT be encoded using this mechanism.

Reference:
http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf

[pitbulk]

I'm also the current maintainer of the ruby-saml gem, but the embed_sign was something implemented before I arrived and is only a trick to let the developers support in an easy way the HTTP-POST binding.

Notice that ruby-saml does not have the "auth" class that manage the SAML flow (At python-saml and php-saml using HTTP-Redirect binding for all messages different than AuthN SAMLResponses, expected on HTTP-POST binding). At ruby-saml the developer may take care of that flow.