NameID encoding and decoding

[Cantor, Scott]

On 8/19/14, 10:48 PM, "Farzan Qureshi" <fqureshi at rosmini.school.nz> wrote:
>
>When a user log out, I get following in the logs (set to DEBUG) that
>Session Manager couldn't find matching NameID. Therefore user is not
>logged out. I am having a feeling may be it is because the attribute is
>encoded before sending to the SP and thus when it returned by SP it is
>encoded and needs to be decoded to match the NameID present in session
>manager. Am I right?

No, you're not right. The value sent to the SP is literally what's stored
in the cache for lookup.

> If yes then how I can achieve a logout?

Figure out why it's not finding the session, I guess.

I seem to recall a bug in which Microsoft dropped part of the NameID
structure when it made the logout request, and that causes a mismatch.
That's a vague memory, so I would search the archive unless somebody else
recalls.

You could trace the outgoing assertion and see what's in the NameID and
compare it to what's in the incoming message.

-- Scott