SAML 2.0 application - option to disable signature check on logout #1307
Description
Description
Introduce a configuration option in the SAML 2.0 application to disable the signature validation for logout requests coming from the external Relying Party (RP).
This feature would allow environments where the RP does not sign the logout messages to still successfully process the logout flow.
Use case
Some external RPs do not sign SAML logout requests or responses. Without this option, logout attempts from such RPs fail because the service expects a valid signature. Allowing the signature check to be disabled provides greater compatibility in these scenarios.
Standards consideration
The SAML 2.0 standard requires that logout messages are signed. Disabling the signature check is therefore a deviation from the standard and should only be used when absolutely necessary.