SAML Logout Issue

[Roehrl Patrick]

Hello,

since one year we're running the Shibboleth IdP (2.4.0). The SP part is an own implementation with OpenSaml (2.6.0).
Normally every thing is working fine and we don't have any problems, but sometimes the logout fails (I know that the SAML logout process isn't fully implemented, but for our needs the logout of the IdP session is sufficient). And it's really only sometimes, which makes it hard to reproduce.

The cause of the failed logout out, is that the found session hasn't the same session id as the active session:
WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:296] - LogoutRequest referenced a session other than the client's current one.
Also if the user logs in and out again (call SP -> redirect to IdP -> has already active session -> PreviousSessionHandler will redirect to SP with valid AuthnResponse), the logout will fail with the same reason.

I already checked the session ids of the AuthnRespone and LogoutRequest and the indexed NameId and the NameId used for querying the session, but they match and they have to match because otherwise the IdP won't find an indexed session.
I also checked the sources of the IdP to understand the session handling but I didn't found a scenario, that would produce different session ids...

Testing scenario: login at 2 SPs, logout of both, login at both SPs again and repeat till it fails.

Our tester used the IE 10 to produce this failure: Are there any known problems with the IE10?
But at the moment I can't really say, if the problem only occurs with IE10.

I also know that you don't know the self implemented SP, but I don't think that there's a problem. Because it runs also with other IdPs (no Shibboleth product) than ours and works fine.

I hope my description of the problem is clear and I didn't forgot any information..

Thanks for your support!

Patrick Röhrl
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150126/3be17629/attachment-0001.html