I'm dealing with a web application hooked up to ADFS as a relying party, for single sign on integration with a partner claims provider. It's all via SAML (not WS Federation.) The web app is .NET and using the WIF SAML extension. All this works for SSO.
What doesn't work is single logOUT to the claims provider. My app via the WIF extension properly redirects to https://adfs.example.com/adfs/ls with the SAML logout request, and ADFS in turn redirects back to me at /saml/redirect/sloresponse. That's all good, but what never happens is any redirect upstream to the claims provider (SAML identity provider) to log out from there. The claims provider does publish a SingleLogoutService in its SAML metadata, and it works when the claims provider talks SAML directly to my web app (without ADFS in the middle.)
Is upstream SAML single logout supported at all in ADFS? Searching online has found me a few cryptic notes that it isn't, but I can't find a definitive source.
If not in ADFS 2.0, is it in ADFS 2.1? We could upgrade to Windows 2012 if necessary.
If not SAML, can ADFS do this using WSFederation? Would both legs need to be WSFed, both the claims provider trust and the relying party trust?
If not possible at all, is there any recommended workaround? Maybe redirect straight to the claims provider and have that push a SAML logout request to ADFS?