Custom SLO - NameId problem in a IDP initiated LogoutRequest

[iljkr at tiscali.it]

  I have this scenario:
-a Shibboleth IDPv4
-two SP: SP_A and
SP_B
(Shibbolet SPv2 with apache)

I tested with succes the SLO offered
by default by shibboleth idp with the velocity templates.

In
alternative to the SLO offered by the default logout.vm we are
implementing a managed logout in a custom java servlet.

In my java
servlet:

>From the http request I have successfully extracted the object
net.shibboleth.idp.session.context.LogoutContext relative to the
execution parameter (e.g. 'e1s1',..).

>From the LogoutContext, and
accessing the configuration files in the idp (e.g. metadata file) I
recovered all the info I need to build a logout response for the
SP.

All works fine (with only one SP) and I have a succes response from
the SP.

When there are more than one SP, I'm trying to build an "IDP
initiated logout request" to the other SP.

I build a simple logout
request, but I get a Logout Response from the SP with the status

urn:oasis:names:tc:SAML:2.0:status:RequestDenied, I think my problem is
with the NameID:

*saml2p:LogoutRequest
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 

Destination="https://SP_B/Shibboleth.sso/SLO/Redirect"

ID="_random_uid"
 IssueInstant="2023-01-12T14:49:18.187Z"

Version="2.0"
 *
 *saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"*https://my-idp-name/*/saml2:Issuer*

*saml:NameID NameQualifier="*????????*/"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
*????????*/saml:NameID* 

*saml2p:SessionIndex*_another_random_uid*/saml2p:SessionIndex*
*/saml2p:LogoutRequest*

I'm
trying various combination for the attribute NameQualifier and for the
value of NameID.

NameQualifier should be the entityid of the idp or the
sp? And about the value of NameID?

The value of the NameID it's
something I can find in some object from:

Multimap multimap =
logoutContext.getSessionMap();

?

Or in other object..?

Setting to
debug level the logs of the SP he gave me no further details.

IJ. 



VOUCHER CONNETTIVITÀ per P.IVA e PMI: internet a canone 0 per 48 mesi. ATTIVA ORA
 https://casa.tiscali.it/promo/?u=https://promozioni.tiscali.it/voucher_business/?r=TS00000A00025&dm=link&p=tiscali&utm_source=tiscali&utm_medium=link&utm_campaign=voucherbusiness&wt_np=tiscali.link.footermail.voucherbusiness.btb..

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20230113/e3179de0/attachment.htm>