[JIRA] Commented: (SSPCPP-400) NameID lookup for logout ignores logical SP boundaries

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13933#comment-13933 ] 

Scott Cantor commented on SSPCPP-400:
-------------------------------------

Original thread on this:
http://marc.info/?l=shibboleth-users&m=131914718629141&w=2

The code is not able to actually retrieve the ancillary sessions because they're associated with a different applicationId, but when the find() fails, it falls through and treats that as a session "not found" and still records it as killed.

To fix this issue, we should probably treat that as an "ignore" case and leave the session in the back-index. The downside is, that will build up over time, so we probably have to consider the risk there.

> NameID lookup for logout ignores logical SP boundaries
> ------------------------------------------------------
>
>                 Key: SSPCPP-400
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-400
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>          Components: SAML 2.0 Logout
>    Affects Versions: 2.4, 2.4.1, 2.4.2, 2.4.3
>            Reporter: Scott Cantor
>            Assignee: Scott Cantor
>             Fix For: 2.5
>
>   Original Estimate: 2 days
>  Remaining Estimate: 2 days
>
> The cache of NameID->Session mappings for logout lookup don't recognize that some sessions are bound to different SP entityID containers, which causes the IdP to issue requests for logout to those entityIDs after the initial request and causes a failure since the sessions are already gone.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira