IDP SLO endpoint confusion

[Wessel, Keith William]

Scott and others,

Now I'm thoroughly confused. I turned up protocol logging to debug and confirmed that, yes, the ASLO extension was being sent from the SP. I then saw that things were working the way they were supposed to this time: no logout page from the SP. I turned debugging back off, and they're still working. So, whatever glitch was causing that I seem to have inadvertently fixed. I wish I knew how, but whatever.

Now, we're back to null pointer exception caused by the presence of this code in my logout.jsp:

		<% if (loginContext.getRelyingPartyId()  == null) { %>
		You have successfully logged out of your service provider session.
		<% ;} else { %>
		You have successfully logged out of
		<%= loginContext.getRelyingPartyId() %>.
		<% ;} %>

Before that, near the top of the logout.jsp, I have (as recommended on the wiki):

<%
    StorageService storageService = HttpServletHelper.getStorageService(application);
    LoginContext loginContext = HttpServletHelper.getLoginContext(storageService,application,request);
%>

So, things seem to be getting initialized okay. But my Tomcat localhost logs indicate a null pointer exception, and my IDP error page tells me logically:

Error Message: Could not dispatch to JSP page.

The SP is definitely using /idp/profile/SAML2/Redirect/SLO, so it should be passing a request, and in fact I saw the request in my IDP log when debugging was turned up. The binding in my metadata associated with my SingleLogoutService URL is urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect which seems to go with the URL I'm using on the IDP..

As you and Peter said last week when I asked about getting the requesting entity ID on this page, it should be available with the method I'm using. Can you think of any othe reasons I'm getting a null pointer exception?

Thanks,
Keith

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, June 06, 2013 11:22 AM
To: Shib Users
Subject: RE: IDP SLO endpoint confusion

> Yeah, I will check. My documentation may be wrong if I used /Logout.

It is, I corrected the page.

> > It's clearly triggering the first part, but not the second part that's associated
> > with ASLO, or I wouldn't be redirected back to the SP.

There's a log message on DEBUG if it detects the extension when it handles the message:

log.debug("Incoming LogoutRequest contains aslo:Asynchronous extension.");

If not, the extension's not there or the code's got a bug in it that I didn't trip over testing it.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net