Backchannel Notify and NameID bound sessions

[Harald Strack]

Hi,

we are using Shibboleth with the SLO extension to SSO/SLO several PHP
applications (Moodle, Mahara, ...) and it works quite well, even with
Backchannel Notify as described here

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPNotify

On application level we implemented more or less the example described
here

https://wiki.shibboleth.net/confluence/display/SHIB2/SLOWebappAdaptation

As long as a user is only logged in once from one browser / client, the
SLO works perfectly. However, when a user is logged in more then once at
the same time, e.g. with two different browsers or from two different
hosts, things getting more complex:

When /Shibboleth.sso/Logout is called from one browser, the SP collects
all sessions of the user based on the NameID and sends a SOAP message to
the <Notify> target that contains all these sessions. 

An implementation of the SOAP-Handler (SLOWebappAdaptation) on
application level  cannot determine the session of the actual Browser
any more and has only two choices:

1) Doing nothing, thus no SLO
2) End (delete) all the sessions, thus logging out on all the machines /
browsers of the user (real SLO!)

Can anyone give me a hint how to extend the example WSDL described at

https://wiki.shibboleth.net/confluence/display/SHIB2/SLOWebappAdaptation

in a way that all <SessionID>s are passed to 

function LogoutNotification($SessionID)?

Here an example of a SOAP message containing 13 sessions (I created this
example with an automated test), the SOAP-Handler is implemented in 
https://moodle.ssystems.de/auth/shibboleth/logout.php


<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body>
<LogoutNotification xmlns="urn:mace:shibboleth:2.0:sp:notify"
type="global">
<SessionID>_31918281ecd4002f992062f24fd56957</SessionID>
<SessionID>_490c5593e13788ddab3c87aeda57a39b</SessionID>
<SessionID>_c731d2ebaf8924e3afbc21f3e4675676</SessionID>
<SessionID>_2985ec8cf8430c7f5d80b423515b3c44</SessionID>
<SessionID>_a532f82f107c248ea01453a9b8f47ef6</SessionID>
<SessionID>_cad53036cdae0229b6ae2f62a396cc01</SessionID>
<SessionID>_3476d1f10142eadf8aaf6d79ec1e21ec</SessionID>
<SessionID>_21a542969068aa7eb2680eb5779ac333</SessionID>
<SessionID>_d347f6de5b78c997ad8debef61417004</SessionID>
<SessionID>_6afb3f050c2b316bac40648c0d32b376</SessionID>
<SessionID>_810b47fb101b442ae7d75c070ce3f784</SessionID>
<SessionID>_7bc801d1254727ba0c710367037b3971</SessionID>
<SessionID>_fba09e423507a216766a8556596092a0</SessionID>
</LogoutNotification>
</S:Body></S:Envelope>

In shibd.log the whole SLO action looks like this:

2012-03-02 09:17:45 DEBUG Shibboleth.Logout.SAML2 [8]: session cache returned 13 sessions bound to NameID in logout request
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_31918281ecd4002f992062f24fd56957)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_490c5593e13788ddab3c87aeda57a39b)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_c731d2ebaf8924e3afbc21f3e4675676)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_2985ec8cf8430c7f5d80b423515b3c44)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_a532f82f107c248ea01453a9b8f47ef6)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_cad53036cdae0229b6ae2f62a396cc01)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_3476d1f10142eadf8aaf6d79ec1e21ec)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_21a542969068aa7eb2680eb5779ac333)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_d347f6de5b78c997ad8debef61417004)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_6afb3f050c2b316bac40648c0d32b376)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_810b47fb101b442ae7d75c070ce3f784)
2012-03-02 09:17:45 INFO Shibboleth.SessionCache [8]: removed session (_7bc801d1254727ba0c710367037b3971)
2012-03-02 09:17:45 DEBUG XMLTooling.SOAPTransport.CURL [8]: getting connection handle to https://moodle.ssystems.de/auth/shibboleth/logout.php
2012-03-02 09:17:45 DEBUG XMLTooling.SOAPTransport.CURL [8]: returning existing connection handle from pool
2012-03-02 09:17:45 DEBUG XMLTooling.SOAPClient [8]: marshalled envelope:
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><LogoutNotification xmlns="urn:mace:shibboleth:2.0:sp:notify" type="global"><SessionID>_31918281ecd4002f992062f24fd56957</SessionID><SessionID>_490c5593e13788ddab3c87aeda57a39b</SessionID><SessionID>_c731d2ebaf8924e3afbc21f3e4675676</SessionID><SessionID>_2985ec8cf8430c7f5d80b423515b3c44</SessionID><SessionID>_a532f82f107c248ea01453a9b8f47ef6</SessionID><SessionID>_cad53036cdae0229b6ae2f62a396cc01</SessionID><SessionID>_3476d1f10142eadf8aaf6d79ec1e21ec</SessionID><SessionID>_21a542969068aa7eb2680eb5779ac333</SessionID><SessionID>_d347f6de5b78c997ad8debef61417004</SessionID><SessionID>_6afb3f050c2b316bac40648c0d32b376</SessionID><SessionID>_810b47fb101b442ae7d75c070ce3f784</SessionID><SessionID>_7bc801d1254727ba0c710367037b3971</SessionID><SessionID>_fba09e423507a216766a8556596092a0</SessionID></LogoutNotification></S:Body></S:Envelope>
2012-03-02 09:17:45 DEBUG XMLTooling.SOAPTransport.CURL [8]: sending SOAP message to https://moodle.ssystems.de/auth/shibboleth/logout.php
2012-03-02 09:17:46 DEBUG XMLTooling.SOAPClient [8]: received XML:
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:LogoutNotificationResponse><OK/></SOAP-ENV:LogoutNotificationResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>

best regards

Harald Strack
-- 
Harald Strack, Dipl.Inf.(FH)
IT Development

ssystems
c/o todo GmbH
Alt-Moabit 60a
10555 Berlin

Tel:     +49 30 2023 6071 - 1
http://www.ssystems.de