Spring Security SAML Logout - Failing at Saml2LogoutResponseFilter - spring-security

Question

We have a simple Saml2-Logout. The user is logged out in the IdP, but the last step, the callback to allow us to kill the session in the application leads to a Http Status: Not Found.
This is our RelyingPartyRegistrationRepository and other configs related to saml2
import org.opensaml.xmlsec.signature.support.SignatureConstants;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.saml2.core.Saml2X509Credential;
import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
import org.springframework.security.web.SecurityFilterChain;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import static org.springframework.security.config.Customizer.withDefaults;
#Profile("!local")
#EnableWebSecurity
#Configuration
public class Saml2WebSecurityConfig {
private static final String LOGOUT_CALLBACK_URL = "/logout/saml2/slo";
private final EIAMConfigProperties eiamConfigProperties;
public Saml2WebSecurityConfig(EIAMConfigProperties eiamConfigProperties) {
this.eiamConfigProperties = eiamConfigProperties;
}
#Bean
public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() throws Exception {
final X509Certificate[] cert = ...;
final PrivateKey privateKey = ...;
final X509Certificate[] verificationCertificate = ...;
Saml2X509Credential signingCredential = Saml2X509Credential.signing(privateKey, cert[0]);
Saml2X509Credential verificationCredential = Saml2X509Credential.verification(verificationCertificate[0]);
RelyingPartyRegistration registration = RelyingPartyRegistration
.withRegistrationId(eiamConfigProperties.getRegistrationId())
.entityId(eiamConfigProperties.getEntity())
.signingX509Credentials(c -> c.add(signingCredential))
.assertingPartyDetails(party -> party.entityId(eiamConfigProperties.getAssertionId())
.singleSignOnServiceLocation(eiamConfigProperties.getSingleSignOnServiceLocation())
.singleSignOnServiceBinding(Saml2MessageBinding.POST)
.singleLogoutServiceLocation(eiamConfigProperties.getSingleLogoutServiceLocation())
.singleLogoutServiceBinding(Saml2MessageBinding.POST)
.wantAuthnRequestsSigned(true)
.signingAlgorithms(sign -> sign.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256))
.verificationX509Credentials(c -> c.add(verificationCredential))
)
.build();
return new InMemoryRelyingPartyRegistrationRepository(registration);
}
#Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated())
.saml2Login(withDefaults())
.saml2Logout((saml2) -> saml2
.logoutRequest((request) -> request.logoutUrl(LOGOUT_CALLBACK_URL))
.logoutResponse((response) -> response.logoutUrl(LOGOUT_CALLBACK_URL))
);
http.csrf().disable();
return http.build();
}
#Bean
public WebSecurityCustomizer webSecurityCustomizer() {
return web -> web.ignoring().requestMatchers(LOGOUT_CALLBACK_URL);
}
}
How do I get Spring Security to expose /logout/saml2/slo and kill the session (or allow me to implement my own session destroy logic).
Edit: With enabled debug-logging I see this:
2023-02-03 14:42:37.845 DEBUG 1 --- [p-nio-80-exec-2] .s.s.p.s.w.a.l.Saml2LogoutResponseFilter : Failed to validate LogoutResponse: [[invalid_destination] Failed to match destination to configured destination] 

Answer 1

I found the solution and will post it for others to help or for future me :)
What was missing was the singleLogoutServiceResponseLocation on RelyingPartyRegistration, which must match the LogoutResponse Destination. Otherwise an exception is thrown by the Saml2LogoutResponseFilter.
#Profile("!local")
#EnableWebSecurity
#Configuration
public class Saml2WebSecurityConfig {
private final EIAMConfigProperties eiamConfigProperties;
public Saml2WebSecurityConfig(EIAMConfigProperties eiamConfigProperties) {
this.eiamConfigProperties = eiamConfigProperties;
}
#Bean
public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() throws Exception {
final X509Certificate[] cert = ...;
final PrivateKey privateKey = ...;
final X509Certificate[] verificationCertificate = ...;
Saml2X509Credential signingCredential = Saml2X509Credential.signing(privateKey, cert[0]);
Saml2X509Credential verificationCredential = Saml2X509Credential.verification(verificationCertificate[0]);
RelyingPartyRegistration registration = RelyingPartyRegistration
.withRegistrationId(eiamConfigProperties.getRegistrationId())
// this was missing and must match the LogoutResponse Destination
.singleLogoutServiceResponseLocation(eiamConfigProperties.getSingleLogoutServiceResponseLocation())
.entityId(eiamConfigProperties.getEntity())
.signingX509Credentials(c -> c.add(signingCredential))
.assertingPartyDetails(party -> party.entityId(eiamConfigProperties.getAssertionId())
.singleSignOnServiceLocation(eiamConfigProperties.getSingleSignOnServiceLocation())
.singleSignOnServiceBinding(Saml2MessageBinding.POST)
.singleLogoutServiceLocation(eiamConfigProperties.getSingleLogoutServiceLocation())
.singleLogoutServiceBinding(Saml2MessageBinding.POST)
.wantAuthnRequestsSigned(true)
.signingAlgorithms(sign -> sign.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256))
.verificationX509Credentials(c -> c.add(verificationCredential))
)
.build();
return new InMemoryRelyingPartyRegistrationRepository(registration);
}
#Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated())
.saml2Login(withDefaults())
.saml2Logout(withDefaults());
http.csrf().disable();
return http.build();
}
}