{"action":"created","issue":{"url":"https://api.github.com/repos/onelogin/python-saml/issues/53","labels_url":"https://api.github.com/repos/onelogin/python-saml/issues/53/labels{/name}","comments_url":"https://api.github.com/repos/onelogin/python-saml/issues/53/comments","events_url":"https://api.github.com/repos/onelogin/python-saml/issues/53/events","html_url":"https://github.com/onelogin/python-saml/issues/53","id":63022225,"number":53,"title":"Unable to logout from IdP (and support for rsa-sha256)","user":{"login":"jacquesd","id":2848217,"avatar_url":"https://avatars.githubusercontent.com/u/2848217?v=3","gravatar_id":"","url":"https://api.github.com/users/jacquesd","html_url":"https://github.com/jacquesd","followers_url":"https://api.github.com/users/jacquesd/followers","following_url":"https://api.github.com/users/jacquesd/following{/other_user}","gists_url":"https://api.github.com/users/jacquesd/gists{/gist_id}","starred_url":"https://api.github.com/users/jacquesd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jacquesd/subscriptions","organizations_url":"https://api.github.com/users/jacquesd/orgs","repos_url":"https://api.github.com/users/jacquesd/repos","events_url":"https://api.github.com/users/jacquesd/events{/privacy}","received_events_url":"https://api.github.com/users/jacquesd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2015-03-19T15:46:49Z","updated_at":"2015-07-16T23:22:52Z","closed_at":null,"body":"Hello,\r\nI am trying to use python-saml to login with the SSO at my workplace.\r\nBut I encountered a few difficulties with doing so by using the `demo-flask` app.\r\n\r\nI managed to perform the login, but I fail to logout and my IdP throws the following error:\r\n\r\n```\r\nThe SAML Single Logout request does not correspond to the logged-in session participant.\r\nRequestor: https:/<my_sp>/metadata/\r\nRequest name identifier: Format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient, NameQualifier:  SPNameQualifier: https://<my_sp>/metadata/, SPProvidedId:\r\nLogged-in session participants:\r\nCount: 1, [Issuer: https://<my_sp>/metadata/, NameID: (Format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient, NameQualifier:  SPNameQualifier: , SPProvidedId: )]\r\n\r\nThis request failed.\r\n```\r\n\r\nFrom what I understand, it seems python-saml is not sending (properly) the identifier which allows the IdP to match the user in the logout request to the use who is logged in.\r\n\r\nI also had troubles with the algorithm to sign the requests.  I need to use `rsa-sha256` for signing the requests as the IdP does not support `rsa-sha1`.\r\n\r\nI had a look and it appears that `rsa-sha1` is used as a  hard coded value in quite a few places. I replaced it with `rsa-sha256` and it worked fine until I hit the error above in the logout request.\r\n\r\nMaybe the two are related, maybe I missed a spot where some of the data is signed using `rsa-sha1`. \r\n\r\nregarding `rsa-sha256` I will fix it properly and submit a PR as soon as possible. \r\nBut I only have a limited knowledge of SAML so I am not sure how to solve the error mentioned above.\r\n\r\nHere is my config, I hope it helps:\r\n```json\r\n\"security\": {\r\n        \"nameIdEncrypted\": false,\r\n        \"authnRequestsSigned\": true,\r\n        \"logoutRequestSigned\": true,\r\n        \"logoutResponseSigned\": true,\r\n        \"signMetadata\": false,\r\n        \"wantMessagesSigned\": true,\r\n        \"wantAssertionsSigned\": true,\r\n        \"wantNameIdEncrypted\": false\r\n},\r\n```\r\nI checked all the certificates are correct and valid.\r\nThe IdP is based on Windows AD FS.\r\n"},"comment":{"url":"https://api.github.com/repos/onelogin/python-saml/issues/comments/122129348","html_url":"https://github.com/onelogin/python-saml/issues/53#issuecomment-122129348","issue_url":"https://api.github.com/repos/onelogin/python-saml/issues/53","id":122129348,"user":{"login":"ThiefMaster","id":179599,"avatar_url":"https://avatars.githubusercontent.com/u/179599?v=3","gravatar_id":"","url":"https://api.github.com/users/ThiefMaster","html_url":"https://github.com/ThiefMaster","followers_url":"https://api.github.com/users/ThiefMaster/followers","following_url":"https://api.github.com/users/ThiefMaster/following{/other_user}","gists_url":"https://api.github.com/users/ThiefMaster/gists{/gist_id}","starred_url":"https://api.github.com/users/ThiefMaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThiefMaster/subscriptions","organizations_url":"https://api.github.com/users/ThiefMaster/orgs","repos_url":"https://api.github.com/users/ThiefMaster/repos","events_url":"https://api.github.com/users/ThiefMaster/events{/privacy}","received_events_url":"https://api.github.com/users/ThiefMaster/received_events","type":"User","site_admin":false},"created_at":"2015-07-16T23:22:52Z","updated_at":"2015-07-16T23:22:52Z","body":"He's currently away but I'm sure he can give it a try once he's back. Thanks for the improvement :)"}}