idpSession with emailAddress NameID

[Szerb, Tamas]

Hello,

I have just ran into the issue, that with the same
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
if the user logs in then cannot log out because of getting
urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal
status message.

This is clearly because of the

http://svn.shibboleth.net/view/java-shib-idp2/tags/2.4.0/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SLOProfileHandler.java?revision=3172&view=markup

255  // Get session corresponding to NameID. This is limited to one
session, which means
256  // we can't know if more than one might have been issued for a
particular NameID.
257  SessionManager<Session> sessionManager = getSessionManager();
258
String nameIDIndex =
getSessionIndexFromNameID(requestContext.getSubjectNameIdentifier());
259 log.debug("Querying SessionManager based on NameID '{}'", nameIDIndex);
260 Session indexedSession = sessionManager.getSession(nameIDIndex);

My question, how to remediate it. We can only use emailAddress at this time
(and SAML standard), and I believe this use case is quite typical. I also
wonder why not having eg. JSESSIONID also used as a key with the NameID?

Thanks,

Tamas

VWOL
Tamas SZERB <toma at rulez.org>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140703/a4df1448/attachment.html