code: protected void validateLogoutRequest(final LogoutRequest logoutRequest, final SAML2MessageContext context,
                                                 final SignatureTrustEngine engine) {
  
          validateSignatureIfItExists(logoutRequest.getSignature(), context, engine);
  
          // don't check because of CAS v5
          //validateIssueInstant(logoutRequest.getIssueInstant());
  
          validateIssuerIfItExists(logoutRequest.getIssuer(), context);
  
          NameID nameId = logoutRequest.getNameID();
          final EncryptedID encryptedID = logoutRequest.getEncryptedID();
          if (encryptedID != null) {
              nameId = decryptEncryptedId(encryptedID, decrypter);
          }
  
          String sessionIndex = null;
          final List<SessionIndex> sessionIndexes = logoutRequest.getSessionIndexes();
          if (sessionIndexes != null && !sessionIndexes.isEmpty()) {
              final SessionIndex sessionIndexObject = sessionIndexes.get(0);
              if (sessionIndexObject != null) {
                  sessionIndex = sessionIndexObject.getSessionIndex();
              }
          }
  
          final String sloKey = computeSloKey(sessionIndex, nameId);
          if (sloKey != null) {
              final String bindingUri = context.getSAMLBindingContext().getBindingUri();
              if (SAMLConstants.SAML2_SOAP11_BINDING_URI.equals(bindingUri)) {
                  logoutHandler.destroySessionBack(context.getWebContext(), sloKey);
              } else {
                  logoutHandler.destroySessionFront(context.getWebContext(), sloKey);
              }
          }
      }
docs: Validates the SAML logout request.
  
  @param logoutRequest the logout request
  @param context the context
  @param engine the signature engine