Question related to "Local Logout" provided by Shibboleth IdP 2.4.0

[Cantor, Scott]

On 8/30/13 7:11 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:

>As soon as user try to login to two browsers, the second browser cannot
>logout.
>
>The log says:
>15:09:54.109 - DEBUG
>[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:2
>59] - Querying SessionManager based on NameID
>'_da8df6f6b68fdbdb75279cba7bae37b4|urn:oasis:names:tc:SAML:2.0:nameid-form
>at:transient|https:/XXXXXXXXX'
>15:09:54.109 - WARN
>[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:2
>96] - LogoutRequest referenced a session other than the client's current
>one.

Compare the transient IDs in both sessions, I bet they're identical.
Unless you set the TTL on the transient very low, the IdP has a bug and
will issue the same transient for the same user on the second login. The
crypto transient plugin is about the only fix for that issue, but setting
the TTL also works around it in most cases.

-- Scott