Compatibility flag should not affect LogoutRequests

machunmei · Mar 26, 2020 · cd2d62d · cd2d62d
1 parent 341c884
commit cd2d62d
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/Sustainsys.Saml2/WebSSO/LogOutCommand.cs b/Sustainsys.Saml2/WebSSO/LogOutCommand.cs
@@ -83,17 +83,17 @@ public static CommandResult Run(
                 var unbindResult = binding.Unbind(request, options);
                 options.Notifications.MessageUnbound(unbindResult);
 
-                if (!options.SPOptions.Compatibility.AcceptUnsignedLogoutResponses)
-                {
-                    VerifyMessageIsSigned(unbindResult, options);
-                }
-
                 switch (unbindResult.Data.LocalName)
                 {
                     case "LogoutRequest":
+                        VerifyMessageIsSigned(unbindResult, options);
                         commandResult = HandleRequest(unbindResult, options);
                         break;
                     case "LogoutResponse":
+                        if (!options.SPOptions.Compatibility.AcceptUnsignedLogoutResponses)
+                        {
+                            VerifyMessageIsSigned(unbindResult, options);
+                        }
                         var storedRequestState = options.Notifications.GetLogoutResponseState(request);
                         var urls = new Saml2Urls(request, options);
                         commandResult = HandleResponse(unbindResult, storedRequestState, options, returnUrl, urls);