Error 404 after processing LogoutResponse from IdP on SP

[Robert Ayrapetyan]

After almost 6 months, upgraded Shibboleth SP to 2.5.3, the issue is 
still there.

Tried to reproduce it on Apache 2.2 - no luck, SP successfully redirects 
to whatever is submitted in "return" query param.
I'm sure it's very easy to locate and fix, the only problem I have is a 
building of Shibboleth SP in Windows env (because of dependencies).

Could win dev community provide a binary Windows (x64) build which 
contains extend DEBUG logging statements around exit-point from 
"SLO/redirect" handler?


On 07/21/2014 19:36, Robert Ayrapetyan wrote:
> Firefox shows same: http://postimg.org/image/ar77si4uz/
>
> IIS log record:
>
> 2014-07-22 01:54:06 127.0.0.1 GET /Shibboleth.sso/SLO/Redirect
> SAMLRequest=5VZZc6NIEn73r3BoHh02l4SOGHmCUwIB...aUVt1YN4mIppOU%2BcYJebsjw0%2FtNEPxZrQXNuLBieCds7nk%2FdWHmaRP2GkFfTdJwWxZyjxDik9krT7hRXJ%2FakBgtaFNabc6TW11Uw4Rw5ys7oeM9zHGwmRJdd9tR4YzDJyXAYjxT7I%2BZo5Wqa2ECI6rWAiHbe5uAK7XijHZuD183ddO9IhCpu1nSoV8DmuwMj3q2EHjNPKHSNYeL1ufDotlFqh5uemZqcyiJBYT3V1K6tb35pvD930k%2FtR7clfujEP%2Fbq1%2FeJ3K4HAX%2F%2FLSAAH98b%2Be%2BnRPxuvbCbMIQYf5kZPh0S%2Fz7vvz78DQ%3D%3D&RelayState=ss%3Amem%3A75dc76fb7a01d2ec959aff2e86301af7f1fbeeb8c7d45f19aeb47d6c7c5af489
>
> 443 rayrapetyan 127.0.0.1
> Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:30.0)+Gecko/20100101+Firefox/30.0
> 404 15 0 27
>
> I've also tried different relayState (cookie) and completely removed
> "return" URL (and RelayState) from queries - everything ends up on 404
> page.
>
> Could someone confirm he has working SLO on Shibboleth SP (IIS7) with
> redirection to "return" URL?
>
>
>
> On 7/21/2014, 5:59:09 PM, Cantor, Scott wrote:
>> On 7/21/14, 8:41 PM, "Robert Ayrapetyan" <robert.ayrapetyan at gmail.com>
>> wrote:
>>
>>> In browser traces 404 page is returned "from" the same page, from which
>>> "Security of LogoutResponse not established." is being returned.
>>> Please see links below: these are traces for signed and non-signed
>>> LogoutResponse. How is that possible?
>>
>> It's not. I'd look at the server logs and use a different browser and
>> tool
>> like Firefox and LiveHeaders.
>>
>> If the SP is returning a 404 there, I really have no idea how. It's not
>> programmed to do that anywhere that I can recall.
>>
>> -- Scott
>>