Facing issue with Single Logout.

[Amit Thukral]

Hi Scott,

I could integrate shibboleth libraries with our product with a wrapper
written over it to work with our reverse proxy product.
Authentication with IDP, Authorization based on attributes returned in
Assertion and SSO works fine.
However, I am facing problem with Single Logout.

Following is the case:
1) After SSO has happened, user initiate a SP-Initiated Logout from SP-1.
2) IDP sends the logout request to SP-2 at "SAML2/SLO/Redirect" handler.
SP-2 pass this request to "shibsp::ServiceProvider::doHandler" but we get
an error.
native.log
========
2014-12-17 21:55:29 DEBUG Shibboleth.Listener [13468] shib_handler
doHandler send: sending message (default/SLO/Redirect)
2014-12-17 21:55:29 DEBUG Shibboleth.Listener [13468] shib_handler
doHandler send: send completed, reading response message
2014-12-17 21:55:29 ERROR Shibboleth.Listener [13468] shib_handler
doHandler send: remoted message returned an error: XML error(s) dur
ing parsing, check log for specifics
2014-12-17 21:55:29 ERROR Shibboleth.ISAPI [13468] shib_handler doHandler:
XML error(s) during parsing, check log for specifics

shibd.log
=========
2014-12-17 21:55:29 ERROR XMLTooling.ParserPool [9] handleError: fatal
error on line 1, column 1, message: An exception occurred!
Type:UTFDataFormatException, Message:invalid byte 1 () of a 1-byte sequence.
2014-12-17 21:55:29 ERROR Shibboleth.Listener [9]: error processing
incoming message: XML error(s) during parsing, check log for specifics

Is it because that the Logout Request reaching at SP-2 contains the
entityID of SP-1 in issuer element which SP-2 has no knowledge of ?
if yes, how to fix this ?
if no, what else could be the reason for above errors ?

Thanks and Regards,
Amit Thukral
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141218/f0a49447/attachment-0001.html