No (successful) logout response received from the url

Error message

No (successful) logout response received from the url [{}]

What it means

CAS sent a back-channel SAML logout message to the SP endpoint but the HTTP exchange failed or returned a non-successful status. The exception is logged via LoggingUtils and this warning indicates the SP did not confirm logout; sendMessageToEndpoint returns false.

Solutions

From the CAS host, curl the SP SLO URL to test reachability and TLS; fix firewall/DNS/proxy issues.
Check the logged exception above the warning for the root cause (connection refused vs HTTP status).
Adjust HttpUtils client settings (timeouts, trust store) if TLS validation blocks the call.
If the SP cannot accept back-channel logout, switch to front-channel or skip SLO for that service.
Verify the SP endpoint expects the binding CAS is using (redirect vs POST vs SOAP).

Example fix

// before: SP unreachable over TLS
// add SP cert to trust store or relax validation in dev
cas.httpclient.trust-store=file:/etc/cas/sp-cert.p12

Defensive patterns

Strategy: retry

Validate before calling

var conn = new URL(sloUrl).openConnection();
conn.setConnectTimeout(3000);
// preflight connectivity check before sending logout message

Try / catch

try {
    sendLogoutMessage(msg);
} catch (IOException e) {
    LOGGER.warn("SLO endpoint unreachable: {}", sloUrl, e);
    // optionally retry or mark logout as failed
}

Prevention

Network-test SP SLO endpoints from CAS hosts (curl/monitoring probes).
Pre-load SP TLS certificates into the trust store.
Set sane HTTP timeouts so failures surface quickly.
Fallback to front-channel logout when back-channel fails.

When it happens

Trigger: sendMessageToEndpoint performs an HTTP call to the SP's SLO URL; network unreachable, TLS failure, connection timeout, HTTP 4xx/5xx, or empty/error body all land in the catch/finally path and produce this warning.

Common situations: SP endpoint behind a firewall or VPN not reachable from CAS; self-signed/expired TLS certs on the SP; SP returns 500 on logout; DNS misconfiguration; SP expects front-channel only.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/d2062d2a6440bd37. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutServiceMessageHandler.java:161

                    .parameters(CollectionUtils.wrap(SamlProtocolConstants.PARAMETER_SAML_REQUEST, message))
                    .headers(CollectionUtils.wrap(HttpHeaders.CONTENT_TYPE, msg.getContentType()))
                    .httpClient(getHttpClient())
                    .build();
                response = HttpUtils.execute(exec);
            }
            if (response != null && response.getCode() == HttpStatus.OK.value()) {
                try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {
                    val result = IOUtils.toString(content, StandardCharsets.UTF_8);
                    LOGGER.trace("Received logout response as [{}]", result);
                    return true;
                }
            }
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        } finally {
            HttpUtils.close(response);
        }
        LOGGER.warn("No (successful) logout response received from the url [{}]", msg.getUrl().toExternalForm());
        return false;
    }

    @Override
    public HttpMessage prepareLogoutHttpMessageToSend(final SingleLogoutRequestContext request, final SingleLogoutMessage logoutMessage) {
        val binding = request.getProperties().get(SamlIdPSingleLogoutServiceLogoutUrlBuilder.PROPERTY_NAME_SINGLE_LOGOUT_BINDING);
        if (SAMLConstants.SAML2_SOAP11_BINDING_URI.equalsIgnoreCase(binding)) {
            val msg = new LogoutHttpMessage(request.getLogoutUrl(), logoutMessage.getPayload(), isAsynchronous());
            msg.setContentType(MediaType.TEXT_XML_VALUE);
            return msg;
        }
        return new LogoutHttpMessage(SamlProtocolConstants.PARAMETER_SAML_REQUEST, request.getLogoutUrl(), logoutMessage.getPayload(), isAsynchronous());
    }
}

View on GitHub (pinned to e7288fc434)