Occasional SAML exception during SP/IdP handshake

[Saimon Moore]

Hi,

I did some further debugging and this only happens if I reattempt auth via
shibboleth after a previous successfull login (via shibboleth).

If I don't completely clear all my session cookies I always get the
exception above. If I do clear session cookies then I don't get the
exception.

I'm unsure wether this issue is due to the existing session in the SP or in
the IdP.

>From what you've said Peter, this looks like it's due to the session
maintained by the IdP.

If on the other hand it's due to the existing session in the SP then after
logging out the user in my application is there anything else I need to do
to invalidate the SP session? I have actually tried to redirect to
/Shibboleth.sso/Logout but that doesn't fix the issue so I'm more inclined
to believe the issue is with the IdP.

If in the IdP is there a url IdP's have I can redirect users to invalidate
the IdP Session (for my SP only) there?

For the time being we are recommending users signing in via shibboleth to
close their browser upon logout but in this day and age this seems a bit
archaic.

Regards,

Saimon




On Fri, Jul 26, 2013 at 11:30 AM, Saimon Moore <saimonmoore at gmail.com>wrote:

> Thanks Peter
>
> I'll take it up with the Idp.
>
>
> On Fri, Jul 26, 2013 at 11:25 AM, Peter Schober <
> peter.schober at univie.ac.at> wrote:
>
>> * Peter Schober <peter.schober at univie.ac.at> [2013-07-26 11:22]:
>> > >     Error from identity provider:
>> > >
>> > >         Status: urn:oasis:names:tc:SAML:2.0:status:Responder
>> > >         Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
>> >
>> > Well, it clearly says "Error from idrentity provider" and the IdP said
>> > "authentication unless you're requesting a specifc authentication
>> > method from that IDP which the IdP cannot provide, there's nothing the
>> > SP can do about it. It's an error from the IdP, after all.
>>
>> Sorry, bad connectivity and typing into a terminal don't go well
>> together. Should have been 'the IdP said "AuthnFailed", so unless...'
>> -peter
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Saimon Moore
> Web Developer @ Teambox.com
> (http://teambox.com)
>
> Skype: saimonmoore
> Yahoo IM: saimonmoore
> Google IM: saimonmoore
>



-- 
Saimon Moore
Web Developer @ Teambox.com
(http://teambox.com)

Skype: saimonmoore
Yahoo IM: saimonmoore
Google IM: saimonmoore
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130731/03e6026a/attachment.html