SLOLogoutProfileHandler not finding Session - configuration ?

[Cantor, Scott]

On 1/6/14, 2:02 PM, "Mackay, Rob" <Rob.Mackay at ellucian.com> wrote:

>Sorry for the lack of clarity
>
>The session is created with index
>'8010001001|urn:oasis:names:tc:SAML:2.0:nameid-format:persistent|https://<
>domain>/idp/shibboleth|urn:federation:MicrosoftOnline'
>
>The Logout constructs the NameID that looks like this
>'8010001001|urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
>
>The session is not found because the session key is not properly
>constructed in the Logoutprofilehandler.

Ok, you had me confused about the issue. That looks more like a bug or an
issue with how the NameQualifiers are being set or defaulted.

The code appears to only operate on what it's given, which means that if
there's defaulting required, it won't work. Since defaulting these is
allowable, though a bad idea, that's a bug.

My best guess, if the qualifiers are being set initially when it creates
the assertion, is that the SP is not Shibboleth and is gratuitously
omitting them in the logout request. Shibboleth doesn't do that, it
populates the request with whatever literally was sent to it.

>I have modified the SLOLogoutProfilehandler during testing to construct
>it correctly and find the session but I don't think I should have to
>modify code to make the session index match should I ?

No.

I thought you meant the other bug, which is that if you fixed all that and
then logged in with two different browsers to the same SP (and thus using
the same NameID), logout with one would orphan the other. That one can't
be fixed.

-- Scott