Does pysaml2 handle encrypted NameId in SLO?

[rpanesar]

Currently initiating a SLO request from another SP, and I'm noticing that my NameId being parsed out from my SP. After looking into the issue it seems the NameId isn't being decrypted within the handle_logout_request function in client.py.

Is there a configuration that can be set via the SP arguments that would resolve this issue?

Current error message I'm receiving is the Wrong user, which is found in on line 522 within client.py.

[c00kiemon5ter]

I do not see handle_logout_request being able to handle encrypted data. This is something we can add as a new feature in the future.
Unfortunately, other things are more important at the moment, but pull requests are always welcome 👍

[christophdb]

Still the case in 7.5.4, and it hits every SP behind a Shibboleth IdP: Shibboleth encrypts the NameID of a front-channel LogoutRequest by default whenever the SP publishes an encryption key. Fix with a test in #1039.