Question related to "Local Logout" provided by Shibboleth IdP 2.4.0

[Yaowen Tu]

Hi Scott,

I will confirm that next Tuesday. Assume that they are identical.

Are you saying that if I fix the issue by using the crypto transient plugin or set TTL to be very low, I should get a a different transient id for the same user on the second login. If that's the case I should be able to do single logout on second browser, is it?

Thanks,
Yaowen

On Aug 31, 2013, at 12:17 PM, Cantor, Scott wrote:

> On 8/30/13 7:11 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
> 
>> As soon as user try to login to two browsers, the second browser cannot
>> logout.
>> 
>> The log says:
>> 15:09:54.109 - DEBUG
>> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:2
>> 59] - Querying SessionManager based on NameID
>> '_da8df6f6b68fdbdb75279cba7bae37b4|urn:oasis:names:tc:SAML:2.0:nameid-form
>> at:transient|https:/XXXXXXXXX'
>> 15:09:54.109 - WARN
>> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:2
>> 96] - LogoutRequest referenced a session other than the client's current
>> one.
> 
> Compare the transient IDs in both sessions, I bet they're identical.
> Unless you set the TTL on the transient very low, the IdP has a bug and
> will issue the same transient for the same user on the second login. The
> crypto transient plugin is about the only fix for that issue, but setting
> the TTL also works around it in most cases.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net