Spring Security 6中SAML2单点登出（SLO）未向SAML服务器发请求

已按Spring Security文档完成SAML2注册配置，登录功能正常，但单点登出（SLO）无法正常工作：

• 向/logout发送POST请求后，仅完成本地系统登出，断言方（AP）未登出
• 未向AP发送saml2:LogoutRequest，SAML会话属性也未清除

调试信息 #

• Saml2LogoutRequestFilter未触发（因端点不匹配且未收到saml2:LogoutRequest对象，属预期情况）
• Saml2LogoutResponseFilter未被使用（该过滤器仅处理AP返回的登出响应）
• 实际被调用的是LogoutFilter，按文档逻辑该过滤器应先完成本地登出，再向AP发送saml2:LogoutRequest，但后者从未执行

相关配置 #

YAML配置 #

spring:
  security:
    saml2:
      relyingparty:
        registration:
          saml:
            acs:
              binding: POST
              location: "{baseUrl}/sso/{registrationId}/response"
            assertingparty:
              entity-id: "http://localhost:8000/saml2/idp/metadata.php"
              metadata-uri: "http://localhost:8000/saml2/idp/metadata.php"
              singlesignon:
                url: "http://localhost:8000/saml2/idp/SSOService.php"
                sign-request: false
              singlelogout:
                url: "http://localhost:8000/saml2/idp/SingleLogoutService.php"
                binding: REDIRECT
            entity-id: "localhost"
            singlelogout:
              url: "{baseUrl}/sso/logout/saml"
              binding: POST
              response-url: "{baseUrl}/sso/logout/saml"

Kotlin过滤器配置 #

@Bean
fun filterChain(http: HttpSecurity/*, registrations: RelyingPartyRegistrationRepository*/): SecurityFilterChain {
    ...
    // saml login
    http.saml2Login { saml2LoginConfigurer ->
        saml2LoginConfigurer
            .authenticationRequestUri("/sso/{registrationId}/login")
            .loginProcessingUrl(samlResponseUrl.replace("{baseUrl}", ""))
            .authenticationManager(ProviderManager(samlAuthenticationProvider()))
            .defaultSuccessUrl(samlRedirectUrl)
            .failureUrl(samlRedirectUrlNewUser)
    }
    // saml (sso) logout
    http.saml2Logout { saml2LogoutConfigurer ->
        saml2LogoutConfigurer
            .logoutRequest { request ->
                request.logoutUrl("/sso/logout/saml")
            }
            .logoutResponse { response ->
                response.logoutUrl("/sso/logout/saml")
            }
    }
}

内容的提问来源于stack exchange，提问作者Jan Kohnert