apereo/cas · warning

Submitting logout response to

Error message

Submitting logout response to [{}] failed with response [{}]

What it means

CAS submitted the SLO logout response to the delegated IdP continuation URL and the HTTP call either returned null or an error status; this is only a logged warning, not a thrown exception. It means the back-channel logout of the provider session may not have completed.

Solutions

1. Verify the IdP's logout/single-logout endpoint URL is reachable from the CAS server (curl the continuation URL)
2. Check network/TLS trust (import the IdP cert into the CAS truststore)
3. Confirm continuation data (relay state, SAML logout response) is valid and not expired
4. Treat as non-fatal if the IdP session was already terminated; otherwise enable debug logging to capture the response body

Example fix

null

// precheck: curl -I <idp-logout-url> from the CAS host to confirm reachability

try { HttpUtils.execute(exec) } catch (Exception e) { LOGGER.warn("Logout continuation failed", e); /* non-fatal */ }

When it happens

Trigger: HttpUtils.execute returns null (network failure, bad URL) or the response code is 4xx/5xx when POSTing continuation.getData() to continuation.getUrl() in DelegatedAuthenticationIdentityProviderLogoutAction.

Common situations: IdP logout endpoint unreachable or behind firewall; expired/invalid relay state; IdP returns 400 for an already-invalidated session; TLS trust not configured for the IdP.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• No (successful) logout response received from the url
• No (successful) logout response received from the url
• Failed to load configuration metadata
• Unable to accept response status
• <policy status exception>

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/f0fb869821aa3c47. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/logout/DelegatedAuthenticationIdentityProviderLogoutAction.java:61

            .orElseThrow(() -> new IllegalArgumentException("Unable to determine delegated client for " + clientName));
        LOGGER.debug("Received logout request from [{}]", client.getName());

        val clientCredential = WebUtils.getCredential(requestContext, ClientCredential.class);
        if (clientCredential != null && HttpMethod.POST.matches(request.getMethod())) {
            webContext.getRequestAttribute(SingleLogoutContinuation.class.getName(), SingleLogoutContinuation.class)
                .stream()
                .filter(continuation -> StringUtils.isNotBlank(continuation.getUrl()))
                .findFirst()
                .ifPresent(continuation -> {
                    val exec = HttpExecutionRequest.builder()
                        .method(continuation.getMethod())
                        .url(continuation.getUrl())
                        .parameters(continuation.getData())
                        .build();
                    LOGGER.debug("Sending delegated logout response to [{}]", exec.getUrl());
                    val logoutResponse = HttpUtils.execute(exec);
                    FunctionUtils.doIf(logoutResponse == null || HttpStatus.valueOf(logoutResponse.getCode()).isError(),
                        r -> LOGGER.warn("Submitting logout response to [{}] failed with response [{}]", continuation.getUrl(), r)).accept(logoutResponse);
                    request.removeAttribute(SingleLogoutContinuation.class.getName());
                });
        }
        return new Event(this, CasWebflowConstants.TRANSITION_ID_PROCEED);
    }
}

View on GitHub (pinned to e7288fc434)