Backchannel Notify and NameID bound sessions

[Harald Strack]

Hi Scott,

On Fri, 2012-03-02 at 15:19 +0000, Cantor, Scott wrote: 
> > When /Shibboleth.sso/Logout is called from one browser, the SP collects
> > all sessions of the user based on the NameID and sends a SOAP message to
> > the <Notify> target that contains all these sessions.
> 
> That's how a SAML logout works, depending on the SessionIndex in the message, but when the SP initiates a logout, it only initiates a logout of the session it's being told to handle. Unless there's a bug anyway, but the code I looked at appears to be sending back channel notification with only a single session.

No, it doesn't send only on one single session. Actually it sends as
much sessions as the user owns on this SP, here the SOAP Request from
shibd.log (13 Sessions):

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body>
<LogoutNotification xmlns="urn:mace:shibboleth:2.0:sp:notify"
type="global">
<SessionID>_31918281ecd4002f992062f24fd56957</SessionID>
<SessionID>_490c5593e13788ddab3c87aeda57a39b</SessionID>
<SessionID>_c731d2ebaf8924e3afbc21f3e4675676</SessionID>
<SessionID>_2985ec8cf8430c7f5d80b423515b3c44</SessionID>
<SessionID>_a532f82f107c248ea01453a9b8f47ef6</SessionID>
<SessionID>_cad53036cdae0229b6ae2f62a396cc01</SessionID>
<SessionID>_3476d1f10142eadf8aaf6d79ec1e21ec</SessionID>
<SessionID>_21a542969068aa7eb2680eb5779ac333</SessionID>
<SessionID>_d347f6de5b78c997ad8debef61417004</SessionID>
<SessionID>_6afb3f050c2b316bac40648c0d32b376</SessionID>
<SessionID>_810b47fb101b442ae7d75c070ce3f784</SessionID>
<SessionID>_7bc801d1254727ba0c710367037b3971</SessionID>
<SessionID>_fba09e423507a216766a8556596092a0</SessionID>
</LogoutNotification>
</S:Body></S:Envelope>

Is this allowed in the schema? 

> > Can anyone give me a hint how to extend the example WSDL described at
> > 
> > https://wiki.shibboleth.net/confluence/display/SHIB2/SLOWebappAdaptation
> > 
> > in a way that all <SessionID>s are passed to
> > 
> > function LogoutNotification($SessionID)?
> 
> Are you talking about what the SP does, or are you talking about some example of an application processing the notify messages? 
> If it's an example, it's just to work from, just change it however you want to.

I was just wondering if someone implemented this (workaround) already in
PHP. The difficulty here is that the SoapServer PHP implementation
cannot handle Arrays (of SessionIDs) directly as parameter - it only
passes the first element (SessionID) to the handler function. However
it's easy to implement the SOAP-Handling in PHP the simple way:

function fakeSoap ($http_post_data) {
header('Content-Type: text/xml');

preg_match_all("/<SessionID>(.*?)<\/SessionID>/", $http_post_data,
$res);
LogoutNotification( $res[1] );

//some error handling here...

echo <<<XML
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Body><SOAP-ENV:LogoutNotificationResponse>
<OK/>
</SOAP-ENV:LogoutNotificationResponse>
</SOAP-ENV:Body></SOAP-ENV:Envelope>
XML;
}

> If there's a WSDL (which I didn't write), then if it's not consistent with the schema the SP uses, that would be wrong, obviously.
That's the question: when only one <SessionID> Element is allowed, than it's correct otherwise not.


> Basically, is the SP sending the right sessions to the notify hook, or not?
All Sessions belong to the same user. But only one of all these Sessions
has been triggered for logout - the others share only the same NameID. 

I am still not sure if this is a bug or a feature...

best regards

Harald 
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Harald Strack, Dipl.Inf.(FH)
IT Development

ssystems
c/o todo GmbH
Alt-Moabit 60a
10555 Berlin

Tel:     +49 30 2023 6071 - 1
http://www.ssystems.de

-- 
Harald Strack, Dipl.Inf.(FH)
IT Development

ssystems
c/o todo GmbH
Alt-Moabit 60a
10555 Berlin

Tel:     +49 30 2023 6071 - 1
http://www.ssystems.de