the process_slo method do not save the in_response_to id

[HichamDz38]

i am working on the SAML SLO,
and i am facing an issue, regarding getting the in_response to with the SLO flow.
with the signle sign on with the method process_response, we get the in response to saved in the auth object
so i can verify the value with the one saved in the cache, and also in the case when there is multiple attempts from multiple users
i can check to wich request this response for,
but in the case of the process_slo, we have a parameter, request_id, and the method verify that, and either process or deny accordingly.
but if i have multiple SLO from multiple users, it's not possible to figure out to wich request the actual response belong,
however if we saved the in response to inside the process_slo that will save the issue,
for now this is what i did,
i want to make sure if the is an issue in the library, or if i am missing something,
greetings

[pitbulk]

Hi @HichamDz38, the logout method stores the request and request_id generated before redirecting the user to the Logout endpoint and gonna be accessible by the get_last_request_id.

If you want to register it in your system, the approach is:

1. Call the logout method
2. Before redirecting the user to the logout URL generated, call get_last_request_id and store it in order to be able to retrieve it later before calling the process_slo.

The process_slo is used to validate LogoutRequest and Logout Responses, but the request_id is only required if you are validating a Logout Response and previously a LogoutRequest was generated by the SP, and that is the logout call.

Let me know if you have any other doubts.

P.S As the customer has an active session on the app protected by the SP, you could store the last_request_id session, and retrieve it to be used on process_slo