Reasons to use/not use HTML local storage?

[Wessel, Keith]

Sorry, Scott, I didn't say that correctly at all. I did get kicked back to the SP with a status of urn:oasis:names:tc:SAML:2.0:status:Responder. No substatus listed... but I could still see how this could be caught and handled.

The IDP log tells me this on login:
2015-11-30 16:39:43,143 - INFO [net.shibboleth.idp.session.impl.StorageBackedIdPSession:387] - Unable to add SP session due to to storage service limitations

And this on attempted SAML logout:
2015-11-30 16:39:53,616 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:315] - Profile Action ProcessLogoutRequest: No active session(s) found matching LogoutRequest
   2015-11-30 16:39:53,617 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: SessionNotFound

So, as expected. I suppose I could require all of my SPs who are calling /Shibboleth.sso/Logout to add a check for the failed SAML logout and explicitly send the user to /idp/profile/Logout. It would at least take care of the IDP session and, since we're not trying to carry out a full single logout of all SP sessions, it would end up just as well. But that means actually getting everyone to implement such code. And all of this to gain the use of SAML Logout which only gives me one desired feature: the ability for an SP to request control back to their own after logout page with the asynchronous logout functionality. Not sure it's worth it.

Keith

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, November 30, 2015 3:56 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Reasons to use/not use HTML local storage?

On 11/30/15, 4:42 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:



>On 11/30/15, 4:36 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:
>
>>Thanks, Scott. Yes, that does, in fact, appear to be the case. I get an IDP error with this feature enabled when performing an SAML logout from my favorite non-Javascript browser (Lynx).
>
>What's the error? That isn't what I would expect, since it's still obligated to tell the SP something. I thought it would actually just return to the SP.

In a quick test, I'm seeing it issue a LogoutResponse to the SP with an UnknownPrincipal substatus, which was my recollection of how it's currently coded to work. That applies to any case where the LogoutRequest's NameID doesn't match, but specifically this case, with a browser turning off JS so falling back to cookies.

It isn't good form, but it's probably possible to trap the event locally and produce a custom error, it's just that the SP will be left without any answer. Which is fine in Shibboleth mostly, but might not be with other SPs (I don't think it works for ADFS for example).

But if an SP is claiming to support logout and not handling errors back, it doesn't really support logout. An error is a likely outcome for all sorts of reasons.

Note that this is different from the behavior at /idp/profile/Logout. That is not a SAML logout, that's a plain redirect to clear the session on that front-channel. And that will simply do the logout and not know that any other SPs are involved so would have to be the usual message you'd get in older versions.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net