Incorrect (stale) user data in SAML2 assertion

[Cantor, Scott]

On 3/12/15, 6:57 AM, "Matthew Slowe" <M.Slowe at kent.ac.uk> wrote:
>
>When they're done, User A logs out & SLO reports success! Everything is as it should be.
>
>User B then starts the whole process again within the same browser... if this
>happens in a shortish space of time then User B's SAML2 assertion generated by
>the Shibboleth IDP for the SP is generated with User A's already resolved
>attributes.

Then SLO is in fact not happening.

Beyond that point, if you want safe behavior in a multi-user environment, you'll have to upgrade to v3. But even in v2 when it incorrectly appends the new user information to the old user session, the old session still has to be there. So it is still there, and there is no logout happening. Whatever's telling you there is is lying (even if it's the IdP, which would indicate a bug in the very limited logout support it includes).

-- Scott