SAML Logout Name Identifier Not Found Error

Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptanceSamlLogoutNameIdentifierNotFoundErrorRule (Rule)

Knowledge Base article:

Summary

SAML logout failed because the SAML Single Logout request does not correspond to the logged-in session participant.

Causes

The following are possible causes for this event:

The logout request does not contain a name ID.
The logout request contains a name ID whose format or value is different from what was issued for this trust.
The logout request contains a stored procedure (SP) name qualifier that does not match the security token service (STS) claim issuance rule.
The user who sent the logout request has never logged in before.

Resolutions

Verify that the claims provider trust or the relying party trust configuration is up to date. Use the AD FS snap-in to make the format of the name ID rule for this partner and its SPNameQualifier value match the name ID that is present in the logout request.

Element properties:

Target

Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptance

Category

ConfigurationHealth

Enabled

True

Event_ID

368

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

SAML Logout Name Identifier Not Found Error

The SAML Single Logout request does not correspond to the logged-in session participant. Check the Alert Context tab for event details about the requester and the logged-in session participant.

Event Log

$Target/Host/Host/Property[Type="Microsoft.ActiveDirectoryFederationServices.2016.FederationServer"]/ADFSEventLog$

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptanceSamlLogoutNameIdentifierNotFoundErrorRule" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptance" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>ConfigurationHealth</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>$Target/Host/Host/Property[Type="Microsoft.ActiveDirectoryFederationServices.2016.FederationServer"]/ADFSEventLog$</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">368</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005RegularExpression</Operator>

              <Pattern>(^AD FS$)</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptanceSamlLogoutNameIdentifierNotFoundErrorRule.AlertMessage"]$</AlertMessageId>

      <Suppression>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>