How to implement single logout using okta as IDP?
<p>In Okta developer account I have enabled the <strong>SAML Single Logout</strong> and get <strong>Identity Provider Single Logout URL</strong>. I have created following logout request using <strong>NameID</strong> and <strong>SessionIndex</strong> obtained from SAML response  that we get during single sign-on process.</p>

<p><strong>Logout Request :</strong></p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://dev-6#####.oktapreview.com/app/nepasoftdev660864_spdemo_1/exk606bnr5BZOBF7z0h7/slo/saml" ID="_b2be5dbd-928a-4554-a879-25a179e36ee2" IssueInstant="2016-03-25T10:20:47Z" Version="2.0"&gt;
   &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;http://192.###.###.##/spdemo&lt;/saml:Issuer&gt;
   &lt;saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"&gt;ramesh.shrestha@nepasoft.com&lt;/saml:NameID&gt;
   &lt;samlp:SessionIndex&gt;id1458901238038.94596883&lt;/samlp:SessionIndex&gt;
&lt;/samlp:LogoutRequest&gt;
</code></pre>

<p>I am getting the following <strong>Logout Response</strong> with status code <strong>RequestDenied</strong></p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;saml2p:LogoutResponse xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://localhost:10262/Logout.aspx" ID="id1846510753301801884197562" InResponseTo="_b2be5dbd-928a-4554-a879-25a179e36ee2" IssueInstant="2016-03-25T10:22:40.389Z" Version="2.0"&gt;
   &lt;saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"&gt;http://192.###.###.##/spdemo&lt;/saml2:Issuer&gt;
   &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
      &lt;ds:SignedInfo&gt;
         &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
         &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
         &lt;ds:Reference URI="#id1846510753301801884197562"&gt;
            &lt;ds:Transforms&gt;
               &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
               &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
            &lt;/ds:Transforms&gt;
            &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
            &lt;ds:DigestValue&gt;LQwvto+ERXvrQRUB7LOUUznSXII=&lt;/ds:DigestValue&gt;
         &lt;/ds:Reference&gt;
      &lt;/ds:SignedInfo&gt;
      &lt;ds:SignatureValue&gt;P+T1K.....ZYvCw==&lt;/ds:SignatureValue&gt;
      &lt;ds:KeyInfo&gt;
         &lt;ds:X509Data&gt;
            &lt;ds:X509Certificate&gt;MIID.....7zK0rH&lt;/ds:X509Certificate&gt;
         &lt;/ds:X509Data&gt;
      &lt;/ds:KeyInfo&gt;
   &lt;/ds:Signature&gt;
   &lt;saml2p:Status&gt;
      &lt;saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied" /&gt;
   &lt;/saml2p:Status&gt;
&lt;/saml2p:LogoutResponse&gt;
</code></pre>

<p>Why might be the <strong>reason for getting RequestDenied</strong> status? Did i missed something on logout request or misconfigured during enabling single logout in Okta?</p>

<p>Thanks in advanced.</p>