Idp Initiated SLO with Hungarian Shib 2.2.1 and Logical SPs

[raghavendra harapanahalli]

I am using Hungarian Shib IDP 2.2.1 on the IDP side to implement IDP
initiated SLO.

On the SP side, i am using Logical SPs ( with Shibooleth SP 2.4.2) to map
two applications hosted on my SSO setup.

When both the applications are logged in to the SSO for a user and i initate
a Global Logout from one of them, the IDP is invoking <LogoutRequest> to all
the Logical SPs sequentially.

The problem is at the SP side since i just have one physical instance of SP
with Logical SP used to map different Applications.

The first <LogoutRequest> to the SP is looking for all the SP session for
that user and IDP Entity ID and clearing them, even those of the other
Logical SPs.

I can even see an error for this is the shibd log.

2011-10-20 04:12:10 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: extracting
issuer from SAML 2.0 protocol message
2011-10-20 04:12:10 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: message from (*
<IDP_ENTITY_ID>*)
2011-10-20 04:12:10 DEBUG OpenSAML.MessageDecoder.SAML2 [4]: searching
metadata for message issuer...
2011-10-20 04:12:10 DEBUG XMLTooling.StorageService [4]: inserted record
(_26d5f05f5f0843950e4b10ee22308f9a) in context (MessageFlow) with expiration
(1319064408)
2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: searching for session
(_c6ea50b2d459cc78b1cbb07dcb94f01b)
2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: reconstituting
session and checking validity
2011-10-20 04:12:10 INFO Shibboleth.SessionCache [4]: request to logout
sessions from (*<IDP_ENTITY_ID>*) for (*<USER>*)
2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: searching for session
(_cae78322e4c5fc8069e3599c31c8943c)
2011-10-20 04:12:10 DEBUG Shibboleth.SessionCache [4]: reconstituting
session and checking validity
2011-10-20 04:12:10 ERROR Shibboleth.SessionCache [4]: an application (*
<Application_ID>*) tried to access another application's session


Although, this request gets a Suceess response to the IDP.

The subsequent <LogoutRequest> hits for the other Logical SPs fail since
their sessions have already been removed.

Kindly suggest if this is a bug or some other issue or incompatibility
between the Hungarian SLO and Shibboleth SP.

Note: I am using my User ID <USER> as the NameID.Not sure if this is the
cause of the problem.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111020/b9a25653/attachment.html