SLO

[JF]

I'm afraid I'm struggling a little with this one.    The SP I want to use the SLO is actually running on the same host as the IdP but to simplify the troubleshooting/logging I have added another SP running on a separate server/domain and am having the same issue.

The stage I'm at is:

Authentication is OK and hitting https://api.iproov.com/Shibboleth.sso/Session shows the session.

If I hit Shibboleth.sso/Logout with the browser I get the "Local Logout - Status of Local Logout: Logout completed successfully." and the SP logs:

2013-06-12 17:38:14 DEBUG Shibboleth.Listener [2]: dispatching message (find::StorageService::SessionCache)
2013-06-12 17:38:14 DEBUG Shibboleth.Listener [2]: dispatching message (default/Logout::run::SAML2LI)
2013-06-12 17:38:14 DEBUG Shibboleth.SessionCache [2]: searching for session (_8cdeae0e18e786de4d8554b61a67885d)
2013-06-12 17:38:14 DEBUG Shibboleth.SessionCache [2]: reconstituting session and checking validity
2013-06-12 17:38:14 WARN Shibboleth.LogoutInitiator.SAML2 [2]: bypassing SAML 2.0 logout, no NameID or issuing entityID found in session
2013-06-12 17:38:14 INFO Shibboleth.SessionCache [2]: removed session (_8cdeae0e18e786de4d8554b61a67885d)


The /Status page shows that I have NameID set to the users login name - does the message mean that I have to have NameID & entityID set as I read it that either will do?


Dom

On 12 Jun 2013, at 07:49, JF <jamesforrest56 at gmail.com> wrote:

> 
> Thanks Scott,
> 
> we do have complete control over the app but I'll follow your suggestion as I suspect this isn't the only time this will come up.  I'll report back here how we get on.
> 
> 
> jf
> 
> On 11 Jun 2013, at 22:39, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> 
>>> I believe an option for achieving this is:
>>> 
>>> 1)	On logout having the user access the
>>> https://aaa.bbb.com/Shibboleth.sso/Logout to terminate the users session
>>> on the SP
>>> 2)	Modifying localLogout.html on the SP to redirect the user to the
>>> localLogout on the IdP
>> 
>> You could, but it would probably be "better" in general to use the SAML protocol for that, if for no other reason than if it doesn't work for this constrained a case, it's not even worth continuing to talk about it.
>> 
>> The local hook is not meant for use by systems that are not tightly coupled, though it sounds like that might be true in this case. To be more explicit, if you don't have direct control over or at least a tight relationship with the systems generating links to the proprietary hook, you're asking for trouble using it, just like any non-standard mechanism.
>> 
>> -- Scott
>> 
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130612/ab04bbed/attachment.html