No (successful) logout response received from the url

Error message

No (successful) logout response received from the url [{}]

What it means

During OpenID Connect single logout, CAS notifies each registered relying party's logout URL with an HTTP request. This warning is logged when the HTTP call completes without receiving a successful (2xx) logout response from the endpoint, and the affected service is skipped (the method returns false). It means the relying party did not confirm the logout request.

Solutions

Verify the service's logout URL is correct and reachable from the CAS server (curl the URL from the CAS host).
Check CAS logs for the underlying HTTP exception/stack trace to distinguish connection failure from an HTTP error status.
Confirm the RP logout endpoint accepts the CAS SLO message format and returns a 2xx response.
If the RP certificate is self-signed, import it into the CAS trust store or fix TLS configuration.
Re-test logout for that specific registered service; the failure only skips one RP, others still receive logout notifications.

Example fix

// before (service definition JSON)
"logoutUrl": "https://rp.example.com/old-logout-path"
// after
"logoutUrl": "https://rp.example.com/cas-oidc/logout"

Defensive patterns

Strategy: validation

Validate before calling

// Verify the logout endpoint from the CAS host before registering the service:
boolean isLogoutUrlReachable(String url) throws Exception {
    HttpURLConnection c = (HttpURLConnection) new URL(url).openConnection();
    c.setConnectTimeout(5000);
    c.setRequestMethod("POST");
    int code = c.getResponseCode();
    return code >= 200 && code < 300;
}

Prevention

Validate the logout URL with a curl/HEAD check from the CAS server before saving the service definition.
Ensure TLS certificates of all relying parties are trusted by the CAS JVM trust store.
Monitor CAS logs for this warning per service to catch RPs whose endpoints silently fail.
Keep RP logout endpoints reachable from the CAS network zone (firewall/proxy rules).

When it happens

Trigger: sendMessageToEndpoint posts the logout message to the registered service's logout URL via HttpUtils; the response code is not 2xx, the connection fails before a response arrives, or the response object is unusable before the success check.

Common situations: Relying party logout endpoint down or behind a firewall/proxy rejecting CAS traffic; logout URL in the OIDC service definition is wrong or uses https with an untrusted certificate; RP rejects the logout payload and returns 4xx; DNS/network issues from the CAS server host or container.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/729c66e127dc1dc3. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/slo/OidcSingleLogoutServiceMessageHandler.java:116

        val payload = logoutMessage.getPayload();
        HttpResponse response = null;
        try {
            val exec = HttpExecutionRequest.builder()
                .method(HttpMethod.POST)
                .url(msg.getUrl().toExternalForm())
                .entity("logout_token=" + payload)
                .headers(CollectionUtils.wrap(HttpHeaders.CONTENT_TYPE, msg.getContentType()))
                .httpClient(getHttpClient())
                .build();
            response = HttpUtils.execute(exec);
            if (response != null && !Objects.requireNonNull(HttpStatus.resolve(response.getCode())).isError()) {
                LOGGER.trace("Received logout response [{}]", response.getCode());
                return true;
            }
        } finally {
            HttpUtils.close(response);
        }
        LOGGER.warn("No (successful) logout response received from the url [{}]", msg.getUrl().toExternalForm());
        return false;
    }
}

View on GitHub (pinned to e7288fc434)