# What exactly means 'Logout request is not signed' in SAML SSO?

**URL:** <https://discuss.elastic.co/t/what-exactly-means-logout-request-is-not-signed-in-saml-sso/155588>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 6, 2018, 5:57pm UTC](https://discuss.elastic.co/t/what-exactly-means-logout-request-is-not-signed-in-saml-sso/155588 "2018-11-06T17:57:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bruno.henriques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno.henriques/32/36920_2.png) [@bruno.henriques](https://discuss.elastic.co/u/bruno.henriques)\
**Post date:** [November 6, 2018, 5:57pm UTC](https://discuss.elastic.co/t/what-exactly-means-logout-request-is-not-signed-in-saml-sso/155588/1 "2018-11-06T17:57:56Z")

</div>

Hello,

I have SSO (using simplesamlphp as IdP) a environment with three services: MyServiceA, MyServiceB and Kibana. I have session on all three services and when I attempt to logout (SLO) from either MyServiceA or MyServiceB I encounter the error 'Logout request is not signed'. Is it possible to disable signature verification from a IdP initiated logout just for the sake of testing and development?

Still reading more on SAML SSO and how these services implement SAML, however I would like to have your insight on this issue.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [November 6, 2018, 9:38pm UTC](https://discuss.elastic.co/t/what-exactly-means-logout-request-is-not-signed-in-saml-sso/155588/2 "2018-11-06T21:38:19Z")

</div>

Hi Bruno,

In general, one should not consume unsigned SAML Logout Requests as there is no integrity or authenticity protection without the signature. How can the SAML SP know that the request originates from the IdP and it is indeed about logging out the specified user ?

There is no way to disable signature verification for incoming SAML Logout Requests in Elasticsearch but you can [enable signing of SAML logout messages in simplesamlphp](https://simplesamlphp.org/docs/stable/simplesamlphp-reference-idp-hosted#section_2_1)

---

<div class="post-metadata">

**Author:** ![bruno.henriques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno.henriques/32/36920_2.png) [@bruno.henriques](https://discuss.elastic.co/u/bruno.henriques)\
**Post date:** [November 6, 2018, 11:08pm UTC](https://discuss.elastic.co/t/what-exactly-means-logout-request-is-not-signed-in-saml-sso/155588/3 "2018-11-06T23:08:37Z")

</div>

Indeed! The logout flow is more clearer to me now 🙂 I am using a version for the single purpose of development and testing.

I am editing the original question to stand out the issue in relation in your response.

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2018, 11:11pm UTC](https://discuss.elastic.co/t/what-exactly-means-logout-request-is-not-signed-in-saml-sso/155588/4 "2018-12-04T23:11:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.