LogoutRequest not fulfilled by IdP

Tue Nov 26 02:04:56 EST 2013

Hi,
 I am trying to send a LogoutRequest from SP to IdP, but the request is not fulfilled by IdP.
idp-process.log says "LogoutRequest did not reference an active session." even though the LogoutRequest contains sessionIndex from Assertion's AuthnStatement.

Here is the LogoutResponse from IdP:
<saml2p:LogoutResponse xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://inw00003973:8443/testsp/SSOLogoutServlet" 
ID="_e480d271c81a2e861f53b50648f108b7" InResponseTo="ec61ed5a-4532-4da2-922c-ac97423fc0e2" IssueInstant="2013-11-26T06:39:56.754Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://inw00003973/idp/shibboleth</saml2:Issuer>
<saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:UnknownPrin
cipal"/></saml2p:StatusCode></saml2p:Status></saml2p:LogoutResponse>

And here is the LogoutRequest (signature/certificate skipped to conserve space):
<saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://inw00003973/idp/profi
le/SAML2/Redirect/SLO" ID="ec61ed5a-4532-4da2-922c-ac97423fc0e2" IssueInstant="2013-11-26T06:39:56.607Z" Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0">
   <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://inw00003973:8443</saml2:Issuer>
   <saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">vasu at abc.com</saml2:NameID>
   <saml2p:SessionIndex>_67ddd3bc159b233ba89ee1a00a330890</saml2p:SessionIndex>
</saml2p:LogoutRequest>

And here is the decrypted Assertion from successful AuthnRequest:
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_5f1be83380ec5ffd716fec00477f2491" IssueInstant="2013-
11-26T06:39:55.911Z" Version="2.0"><saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://inw00003973/idp/shibboleth</saml2:Issuer>
<saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="https://inw00003973/idp/shibboleth"
 SPNameQualifier="https://inw00003973:8443">vasu at abc.com</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="192.168.1.8" InResponseTo="49815679-033d-439b
-97ad-1ebe85d60568" NotOnOrAfter="2013-11-26T06:44:55.911Z" Recipient="https://inw00003973:8443/testsp/AcsServlet"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2013-11-26T06:39:55.911Z" NotOnOrAfter="2
013-11-26T06:44:55.911Z"><saml2:AudienceRestriction><saml2:Audience>https://inw00003973:8443</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2013-11-26T06:39:55.894Z" SessionIndex
="_67ddd3bc159b233ba89ee1a00a330890"><saml2:SubjectLocality Address="192.168.1.8"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></sam
l2:AuthnContext></saml2:AuthnStatement></saml2:Assertion>

Here is the idp-process.log:
12:09:55.927 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:331] - secondarily indexing user session by name identifier
12:09:55.927 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:796] - Encoding response to SAML request 49815679-033d-439b-97ad-1ebe85d60568 from relying party https://inw00003973:8443
12:09:55.932 - INFO [Shibboleth-Audit:1028] - 20131126T063955Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|49815679-033d-439b-97ad-1ebe85d60568|https://inw00003973:8443|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://inw00003973/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_15a6abe08275ebb79e7ddbec5b820ac1|user2|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||vasu@abc.com||
12:09:56.749 - INFO [Shibboleth-Access:73] - 20131126T063956Z|192.168.1.8|inw00003973:443|/profile/SAML2/Redirect/SLO|
12:09:56.749 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SLO
12:09:56.749 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler
12:09:56.749 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:154] - Processing incoming SAML LogoutRequest
12:09:56.750 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:502] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
12:09:56.753 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:516] - Decoded request from relying party 'https://inw00003973:8443'
12:09:56.753 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:259] - Querying SessionManager based on NameID 'vasu at abc.com|urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
12:09:56.753 - INFO [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:266] - LogoutRequest did not reference an active session.
12:09:56.754 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:796] - Encoding response to SAML request ec61ed5a-4532-4da2-922c-ac97423fc0e2 from relying party https://inw00003973:8443
12:09:56.775 - INFO [Shibboleth-Audit:1028] - 20131126T063956Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|ec61ed5a-4532-4da2-922c-ac97423fc0e2|https://inw00003973:8443|urn:mace:shibboleth:2.0:profiles:saml2:logout|https://inw00003973/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e480d271c81a2e861f53b50648f108b7|user2|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||vasu@abc.com||

Thanks,
Vasu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131125/15f0c2ec/attachment-0001.html 