Using spring-security and spring-security-saml2-service-provider 6.2.0, I don’t get how the logout request from the IDP is processed.

The App receive the http request on /logout/saml2/slo, containing nameID and sessionIndex in the saml request, but it comes with no sessionId cookie in the header.
Therefore, when in class Saml2LogoutRequestFilter, the logout does not happen, the request session being null.

this.handler.logout(request, responsen authentication)

at that point the Handler is a SecurityContextLogoutHandler.

My questions:
Should the http request contain a session cookie?
Should the framework find the session based on the sessionIndex in samlrequest? and if so why doesn’t it? wrong handler ?
Should I be implementing my own logoutHandler to find and terminate the session based on the sessionIndex of the saml request?

Thanks