SLOLogoutProfileHandler not finding Session - configuration ?

[Mackay, Rob]

Sorry for the lack of clarity

The session is created with index 
'8010001001|urn:oasis:names:tc:SAML:2.0:nameid-format:persistent|https://<domain>/idp/shibboleth|urn:federation:MicrosoftOnline'

The Logout constructs the NameID that looks like this
'8010001001|urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'

The session is not found because the session key is not properly constructed in the Logoutprofilehandler.

I have modified the SLOLogoutProfilehandler during testing to construct it correctly and find the session but I don't think I should have to modify code to make the session index match should I ?

- Rob

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, January 06, 2014 11:55 AM
To: Shib Users
Subject: Re: SLOLogoutProfileHandler not finding Session - configuration ?

On 1/6/14, 1:36 PM, "Mackay, Rob" <Rob.Mackay at ellucian.com> wrote:

>The session is not found by the SLOLogoutProfileHandler because the 
>NameID does not contain the Destination or Issuer in the session index 
>creation method.

Neither of those fields is relevant to logout or session indexing, but beyond that I don't know what method you mean. The cache is fundamentally incapable of supporting logout unless the identifiers issued are unique (i.e., transients, and even then you have to take care). That's not fixable. It cannot return more than one session for a given identifier, so by definition if there's more than one session involved, it will not be able to process logouts without problems.

>My question
>Is there a configuration element that would allow me to include the 
>additional values in the lookup index for Logout or should the creation 
>of the index exclude these properties by configuration to allow  the 
>session ids to match ?

I don't really understand any of that, but there is nothing you can configure that fixes the design limitations of the session cache.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net