SAML2 logout failing - Unknown Principal

[Catalin Iosif]

Hello,

I have a setup with SAML2 logout, and the logout fails do to a session not being found for the SP. Here is the debug message:

2016-02-16 16:28:13,202 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:269] - Profile Action ProcessLogoutRequest: IdP session ab60efc79be181806cc0306bfa520c79bd5aa982988878c822804125f35b587e does not contain a matching SP session

The status in the Logout response is:

<saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
            <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal"/>
        </saml2p:StatusCode>
        <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
    </saml2p:Status>

I've checked the NameID in the login response and the NameID in the logout request and they are the same. Also, I didn't found any errors in the section where the session was saved.

Any configuration problems that might cause this?

Thanks,
Catalin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160216/1092754e/attachment.html>