Error Response from ShibbolethSP SLO endpoint

[Cantor, Scott]

On 12/12/11 8:19 AM, "Seylok" <seylok at hotmail.com> wrote:
>I am trying to get a front-channel SLO scenario working. I am sending
>signed SAML 2.0 Logout Request messages to the
>/Shibboleth.sso/SLO/Redirect endpoint of a Win32 ShibbolethSP 2.4.3
>installation, but all I get in return is a SAML 2.0 Response with an
>error message ("Error processing request.").

That error signifies that the session obtained from the NameID in the
logout request does not match a session active for the request made to the
front channel endpoint. As noted in several threads, this is currently a
requirement. Only back channel requests can be made in the absence of the
session cookie and an active session. A RFE is filed (I think) to relax
that restriction.

-- Scott