{"record":{"id":"d2062d2a6440bd37","repo":"apereo/cas","slug":"no-successful-logout-response-received-from-the-d2062d","errorCode":null,"errorMessage":"No (successful) logout response received from the url [{}]","messagePattern":"No \\(successful\\) logout response received from the url \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutServiceMessageHandler.java","lineNumber":161,"sourceCode":"                    .parameters(CollectionUtils.wrap(SamlProtocolConstants.PARAMETER_SAML_REQUEST, message))\n                    .headers(CollectionUtils.wrap(HttpHeaders.CONTENT_TYPE, msg.getContentType()))\n                    .httpClient(getHttpClient())\n                    .build();\n                response = HttpUtils.execute(exec);\n            }\n            if (response != null && response.getCode() == HttpStatus.OK.value()) {\n                try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {\n                    val result = IOUtils.toString(content, StandardCharsets.UTF_8);\n                    LOGGER.trace(\"Received logout response as [{}]\", result);\n                    return true;\n                }\n            }\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        } finally {\n            HttpUtils.close(response);\n        }\n        LOGGER.warn(\"No (successful) logout response received from the url [{}]\", msg.getUrl().toExternalForm());\n        return false;\n    }\n\n    @Override\n    public HttpMessage prepareLogoutHttpMessageToSend(final SingleLogoutRequestContext request, final SingleLogoutMessage logoutMessage) {\n        val binding = request.getProperties().get(SamlIdPSingleLogoutServiceLogoutUrlBuilder.PROPERTY_NAME_SINGLE_LOGOUT_BINDING);\n        if (SAMLConstants.SAML2_SOAP11_BINDING_URI.equalsIgnoreCase(binding)) {\n            val msg = new LogoutHttpMessage(request.getLogoutUrl(), logoutMessage.getPayload(), isAsynchronous());\n            msg.setContentType(MediaType.TEXT_XML_VALUE);\n            return msg;\n        }\n        return new LogoutHttpMessage(SamlProtocolConstants.PARAMETER_SAML_REQUEST, request.getLogoutUrl(), logoutMessage.getPayload(), isAsynchronous());\n    }\n}\n","sourceCodeStart":143,"sourceCodeEnd":176,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutServiceMessageHandler.java#L143-L176","documentation":"CAS sent a back-channel SAML logout message to the SP endpoint but the HTTP exchange failed or returned a non-successful status. The exception is logged via LoggingUtils and this warning indicates the SP did not confirm logout; sendMessageToEndpoint returns false.","triggerScenarios":"sendMessageToEndpoint performs an HTTP call to the SP's SLO URL; network unreachable, TLS failure, connection timeout, HTTP 4xx/5xx, or empty/error body all land in the catch/finally path and produce this warning.","commonSituations":"SP endpoint behind a firewall or VPN not reachable from CAS; self-signed/expired TLS certs on the SP; SP returns 500 on logout; DNS misconfiguration; SP expects front-channel only.","solutions":["From the CAS host, curl the SP SLO URL to test reachability and TLS; fix firewall/DNS/proxy issues.","Check the logged exception above the warning for the root cause (connection refused vs HTTP status).","Adjust HttpUtils client settings (timeouts, trust store) if TLS validation blocks the call.","If the SP cannot accept back-channel logout, switch to front-channel or skip SLO for that service.","Verify the SP endpoint expects the binding CAS is using (redirect vs POST vs SOAP)."],"exampleFix":"// before: SP unreachable over TLS\n// add SP cert to trust store or relax validation in dev\ncas.httpclient.trust-store=file:/etc/cas/sp-cert.p12","handlingStrategy":"retry","validationCode":"var conn = new URL(sloUrl).openConnection();\nconn.setConnectTimeout(3000);\n// preflight connectivity check before sending logout message","typeGuard":null,"tryCatchPattern":"try {\n    sendLogoutMessage(msg);\n} catch (IOException e) {\n    LOGGER.warn(\"SLO endpoint unreachable: {}\", sloUrl, e);\n    // optionally retry or mark logout as failed\n}","preventionTips":["Network-test SP SLO endpoints from CAS hosts (curl/monitoring probes).","Pre-load SP TLS certificates into the trust store.","Set sane HTTP timeouts so failures surface quickly.","Fallback to front-channel logout when back-channel fails."],"tags":["http","network","slo"],"backgroundTag":"http-request-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}