Logout error issues?

[David Langenberg]

Hi,

Trying to get the new logout support working, and running into an issue.
 When I request a logout from my SP it sends me back to the correct handler
on the IdP.  The request comes in with the aslo:Asynchronous extension.
 The IdP appears in the logs to perform the logout and indeed the session
is dead:

18:31:15.437 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for
https://shib-sp.uchicago.edu/shibboleth
18:31:15.437 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134]
- No custom relying party configuration found for
https://shib-sp.uchicago.edu/shibboleth, looking up configuration based on
metadata groups.
18:31:15.437 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
- No custom or group-based relying party configuration found for
https://shib-sp.uchicago.edu/shibboleth. Using default relying party
configuration.
18:31:15.440 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:487]
- No response requested, so skipping endpoint selection.
18:31:15.440 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:259]
- Querying SessionManager based on NameID
'_062271bd3413d9c85c1240f78d08af5e|urn:oasis:names:tc:SAML:2.0:nameid-format:transient|
https://shib-sandbox.uchicago.edu/idp/shibboleth|https://shib-sp.uchicago.edu/shibboleth
'
18:31:15.456 - INFO
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:178]
- Invalidating session identified by LogoutRequest:
eb1b0b0d0f237ea17070d6cf3aa135a00b14dbba34f19d4490236480c3495540
18:31:15.490 - INFO [Shibboleth-Audit:1028] -
20130510T233115Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_ae42a616bbddb0385a84eb0b319105c1|
https://shib-sp.uchicago.edu/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:logout|https://shib-sandbox.uchicago.edu/idp/shibboleth|null|null|davel|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_062271bd3413d9c85c1240f78d08af5e||

However, it then dumps me at error.jsp with no discernable error message
instead of logout.jsp.

If I have an currently active session and hit the local logout handler, I
get the same thing:

18:40:56.097 - INFO [Shibboleth-Access:73] -
20130510T234056Z|205.208.122.92|shib-sandbox.uchicago.edu:443
|/profile/Logout|
18:40:56.097 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86]
- shibboleth.HandlerManager: Looking up profile handler for request path:
/Logout
18:40:56.098 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97]
- shibboleth.HandlerManager: Located profile handler of the following type
for the request path:
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler
18:40:56.098 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:151]
- Processing logout request
18:40:56.098 - INFO
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:184]
- Invalidating session identified from client request:
5cb8ad2f8c55980dc2bdcffbdbf2512a34e5e43ad9987f248c56b190baeff3a7

However, if I do NOT have an active session and hit the local logout
handler I get the expected behavior.

There are 2 differences between our setup and stock.  First we're using the
Memcache storage service.  Second, we have a custom login handler for
dealing with Assurance.  This behavior happens whether we use the stock
UsernamePassword Login Handler or our Assurance Login Handler.

Thoughts? Ideas?

Dave

-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130510/e48f2b9e/attachment.html