Skip to main content

SAML LogoutRequest Fails due to the NameID Being Encrypted

The SAML LogoutRequest fails when the NameID is provided in encrypted form, preventing the logout request from being processed successfully.

Description

The SAML Single Logout (SLO) process fails when the NameID included in the SAML LogoutRequest is encrypted.

During the logout flow, the Identity Provider (IdP) generates a SAML LogoutRequest containing an encrypted NameID. The LogoutRequest is received by Blackboard Learn, but the request cannot be successfully processed because the encrypted NameID cannot be resolved or handled as expected.

As a result, the user's SAML session is not terminated successfully, and the logout process does not complete as expected.

Steps to Replicate

  1. Login to Blackboard Learn as administrator

  2. Confirm that SAML authentication and Single Logout are configured for the Blackboard Learn environment

  3. Open a private or incognito browser window

  4. Navigate to the Blackboard Learn login page

  5. Select the SAML authentication option

  6. Sign in with a valid test user through the configured Identity Provider

  7. Use a SAML tracing tool to capture the authentication response

  8. Verify that the authentication response contains an unencrypted NameID with the expected Format attribute.

  9. From Blackboard Learn, select Sign Out to initiate the SAML Single Logout process

  10. Capture the SAML traffic generated during sign-out

  11. Inspect the generated LogoutRequest

  12. Verify that the NameID in the LogoutRequest is encrypted or does not include the Format attribute

  13. Allow the logout request to complete

  14. Observe that Single Logout fails and the user is not successfully signed out

  15. Inspect the SAML response for a Responder status and a generic error message

Expected Behavior:
The SAML Single Logout process completes successfully, and the user’s Blackboard Learn and Identity Provider sessions are terminated. The LogoutRequest contains a valid NameID corresponding to the one established during authentication, including the required Format attribute.

Observed Behavior:
The SAML logout process fails when the LogoutRequest contains an encrypted NameID without the expected Format attribute. The user is not successfully signed out, and the SAML response may return a Responder status with a

Affected Versions

  • Learn 4000.21.0

  • Learn 4001.0.0

Target Release

Future Reference

Did this answer your question?

Related Articles