# Getting "status:AuthnFailed" in \<saml2p:LogoutResponse

**URL:** <https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948>\
**Category:** Questions\
**Created:** [April 18, 2020, 5:04pm UTC](https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948 "2020-04-18T17:04:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rajnath](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@Rajnath](https://devforum.okta.com/u/Rajnath)\
**Post date:** [April 18, 2020, 5:04pm UTC](https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948/1 "2020-04-18T17:04:32Z")

</div>

I am using MS CRM dynamic CRM portal as SP and using Okta as IDP. I can succesfully login. And when I tried to logout getting  
\<saml2p:StatusCode Value=“urn:oasis:names:tc:SAML:2.0:status:AuthnFailed”/\> \</saml2p:Status\>  
In saml2p:LogoutResponse response. Please suggest what is the error due to that at IDP side signout is not working. Please help on this .

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [April 19, 2020, 4:20pm UTC](https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948/2 "2020-04-19T16:20:47Z")

</div>

Have you setup logout at Okta, sorry for a dumb question?

---

<div class="post-metadata">

**Author:** ![Rajnath](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@Rajnath](https://devforum.okta.com/u/Rajnath)\
**Post date:** [April 19, 2020, 5:26pm UTC](https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948/3 "2020-04-19T17:26:57Z")

</div>

Yes, I have setup logout at Okta end. I have uploaded Okta certificate in advance setting and configure single signout url.

**Logout Request**

\<saml2p:LogoutRequest xmlns:saml2p=“urn:oasis:names:tc:SAML:2.0:protocol” xmlns:saml2=“urn:oasis:names:tc:SAML:2.0:assertion” ID="\_b1b21e4f-d38a-42b3-87e2-20c9048117af" Version=“2.0” IssueInstant=“2020-04-19T12:38:05.7909718Z” Destination=“[https://dev-468059.okta.com/app/gldev468059\_communitytip\_1/exk5m6moirfv8qays4x6/slo/saml](https://dev-468059.okta.com/app/gldev468059_communitytip_1/exk5m6moirfv8qays4x6/slo/saml)” NotOnOrAfter=“2020-04-19T12:48:05.7909718Z”\>  
saml2:Issuer[http://www.okta.com/exk5m6moirfv8qays4x6](http://www.okta.com/exk5m6moirfv8qays4x6)\</saml2:Issuer\>  
\<saml2:NameID Format=“urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified”\>[rajnath1987@gmail.com](mailto:rajnath1987@gmail.com)\</saml2:NameID\>  
saml2p:SessionIndex\_243bdf2a-eeaf-4942-a5ad-9c6b7920aeea\</saml2p:SessionIndex\>  
\</saml2p:LogoutRequest\>

---

<div class="post-metadata">

**Author:** ![Rajnath](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@Rajnath](https://devforum.okta.com/u/Rajnath)\
**Post date:** [April 19, 2020, 5:32pm UTC](https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948/4 "2020-04-19T17:32:21Z")

</div>

I checked in Okta System Log, getting following message  
**User single sign out from app**  
**failure : Invalid Signature**

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [April 19, 2020, 6:15pm UTC](https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948/5 "2020-04-19T18:15:47Z")

</div>

Then the certificate, which you uploaded to okta is not the correct one from MS CRM. Double check, it’s a correct certificate

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 11:17pm UTC](https://devforum.okta.com/t/getting-status-authnfailed-in-saml2p-logoutresponse/8948/6 "2024-01-23T23:17:29Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.