A logout request sent to the SimpleSAMLphp IdP that contains the asynchronous SLO extension should not result in a response being sent back to the SP. The asynchronous SLO extension signals to the IdP that a response is not needed. But when a logout request is received by SimpleSAMLphp that contains the following, SimpleSAMLphp still attempts to respond:
<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="https://idpproxy.example.edu/simplesaml/module.php/saml/idp/singleLogout"
ID="_57b1048a00835d2fa345f8661ff90100"
IssueInstant="2026-08-04T20:38:32Z"
Version="2.0"
>
...
samlp:Extensions
<aslo:Asynchronous xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo" />
</samlp:Extensions>
...
</samlp:LogoutRequest>
If the SP metadata contains a logout endpoint, SimpleSAMLphp sends a response to it even with this element present. In trying to circumvent this, we removed the logout endpoint from the SP metadata. After this, SimpleSAMLphp still tried to respond and threw an unhandled exception because there was no SLO endpoint to respond to.
Desired behavior would be for SimpleSAMLphp to continue logging the user out without trying to respond to this SP.
A logout request sent to the SimpleSAMLphp IdP that contains the asynchronous SLO extension should not result in a response being sent back to the SP. The asynchronous SLO extension signals to the IdP that a response is not needed. But when a logout request is received by SimpleSAMLphp that contains the following, SimpleSAMLphp still attempts to respond:
<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="https://idpproxy.example.edu/simplesaml/module.php/saml/idp/singleLogout"
ID="_57b1048a00835d2fa345f8661ff90100"
IssueInstant="2026-08-04T20:38:32Z"
Version="2.0"
>
...
samlp:Extensions
<aslo:Asynchronous xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo" />
</samlp:Extensions>
...
</samlp:LogoutRequest>
If the SP metadata contains a logout endpoint, SimpleSAMLphp sends a response to it even with this element present. In trying to circumvent this, we removed the logout endpoint from the SP metadata. After this, SimpleSAMLphp still tried to respond and threw an unhandled exception because there was no SLO endpoint to respond to.
Desired behavior would be for SimpleSAMLphp to continue logging the user out without trying to respond to this SP.