IDP v3.2.1 SLO issue
Alex Moskvin
moskvin.aleksey at gmail.com
Mon Feb 29 10:29:12 EST 2016
Hi all,
I am trying to get SLO to work in 3.2.1 version.
When I invoke /idp/profile/Logout URL, I see list of my SPs that
participate in the session but they are shown with a red cross and logout
on them doesn't happen. According to the traffic sniffing results no of
them receive any requests from neither browser nor from IDP itself.
My service providers are spring-security-saml based.
SP metadata has following entry for SLO
<md:SingleLogoutService Binding=
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://d01app.qwerty.com:443/bridge-web/saml/SingleLogout"/>
idp.properties look as follows.
idp.additionalProperties= /conf/ldap.properties,
/conf/saml-nameid.properties, /conf/services.properties
idp.entityID= https://d01idp.qwerty.com/idp/shibboleth
idp.scope= qwerty.com
idp.sealer.storeResource= %{idp.home}/credentials/sealer.jks
idp.sealer.versionResource= %{idp.home}/credentials/sealer.kver
idp.sealer.storePassword= secret
idp.sealer.keyPassword= secret
idp.signing.key=/etc/pki_qwerty/CA/private/ca.key
idp.signing.cert=/etc/pki_qwerty/CA/certs/ca.pem
idp.encryption.key=/etc/pki_qwerty/CA/private/ca.key
idp.encryption.cert=/etc/pki_qwerty/CA/certs/ca.pem
idp.encryption.optional = true
idp.storage.cleanupInterval = PT30M
idp.errors.detailed = true
idp.session.enabled = true
idp.session.StorageService = shibboleth.JPAStorageService
idp.session.slop = P1D
idp.session.trackSPSessions = true
idp.session.secondaryServiceIndex = true
idp.session.defaultSPlifetime = PT8H
idp.authn.flows=Password
idp.logout.elaboration=true
idp.replayCache.StorageService=shibboleth.JPAStorageService
idp.artifact.StorageService=shibboleth.JPAStorageService
idp.status.accessPolicy=AccessByIPAddress
idp.resolvertest.accessPolicy=AccessByIPAddress
idp.reload.accessPolicy=AccessByIPAddress
idp.ui.fallbackLanguages=en
idp.cas.StorageService=shibboleth.JPAStorageService
We use shibboleth.JPAStorageService for storing session data - according to
the DB contents everything looks fine.
When /idp/profile/Logout is invoked in logs there are following entries:
2016-02-29 16:10:20,590 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:707] -
Performing primary lookup on session ID
b7a7b9e0569e0ff02e5a9a80606f966305f8232ed71b22a2daf01eed4572c145
2016-02-29 16:10:20,597 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:607] - Loading
SPSession for service sp-app-wss in session
b7a7b9e0569e0ff02e5a9a80606f966305f8232ed71b22a2daf01eed4572c145
2016-02-29 16:10:20,601 - DEBUG
[net.shibboleth.idp.session.SPSessionSerializerRegistry:86] - Registry
located StorageSerializer of type
'net.shibboleth.idp.saml.session.impl.SAML2SPSessionSerializer' for
SPSession type 'class net.shibboleth.idp.saml.session.SAML2SPSession'
2016-02-29 16:10:20,602 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:607] - Loading
SPSession for service sp-app-bridge in session
b7a7b9e0569e0ff02e5a9a80606f966305f8232ed71b22a2daf01eed4572c145
2016-02-29 16:10:20,605 - DEBUG
[net.shibboleth.idp.session.SPSessionSerializerRegistry:86] - Registry
located StorageSerializer of type
'net.shibboleth.idp.saml.session.impl.SAML2SPSessionSerializer' for
SPSession type 'class net.shibboleth.idp.saml.session.SAML2SPSession'
2016-02-29 16:10:20,607 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:552] -
Destroyed session
b7a7b9e0569e0ff02e5a9a80606f966305f8232ed71b22a2daf01eed4572c145
2016-02-29 16:10:20,608 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,608 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,609 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,609 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,609 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,610 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,610 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,610 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,610 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,611 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-wss
2016-02-29 16:10:20,611 - DEBUG
[net.shibboleth.idp.session.impl.PopulateMultiRPContextFromLogoutContext:220]
- Profile Action PopulateMultiRPContextFromLogoutContext:
SAMLMetadataContext added to RelyingPartyContext for sp-app-wss
2016-02-29 16:10:20,611 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,612 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,612 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,612 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,613 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,613 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,613 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,613 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,614 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,614 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,614 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,615 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,615 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,615 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] -
Metadata backing store does not contain any EntityDescriptors with the ID:
sp-app-bridge
2016-02-29 16:10:20,615 - DEBUG
[net.shibboleth.idp.session.impl.PopulateMultiRPContextFromLogoutContext:220]
- Profile Action PopulateMultiRPContextFromLogoutContext:
SAMLMetadataContext added to RelyingPartyContext for sp-app-bridge
2016-02-29 16:10:20,620 - INFO [Shibboleth-Audit.Logout:241] -
20160229T151020Z||||http://shibboleth.net/ns/profiles/logout||||tuser|||||
2016-02-29 16:10:20,962 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-wss'
2016-02-29 16:10:20,962 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-wss'
2016-02-29 16:10:20,962 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-bridge'
2016-02-29 16:10:20,962 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-bridge'
2016-02-29 16:10:22,949 - DEBUG
[net.shibboleth.idp.session.impl.SaveLogoutContext:77] - Profile Action
SaveLogoutContext: Saving LogoutContext in HTTP session
2016-02-29 16:10:22,951 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-wss'
2016-02-29 16:10:22,952 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-wss'
2016-02-29 16:10:22,952 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-bridge'
2016-02-29 16:10:22,952 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual
scheme, returning name of 'sp-app-bridge'
2016-02-29 16:10:27,257 - WARN
[net.shibboleth.idp.session.impl.PopulateLogoutPropagationContext:178] -
LogoutContext not found in HTTP session. Required state not found: {}
2016-02-29 16:10:27,257 - INFO [Shibboleth-Audit.LogoutPropagation:241] -
20160229T151027Z||||
http://shibboleth.net/ns/profiles/logout-propagation|||||||||
2016-02-29 16:10:27,257 - DEBUG
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile
Action RecordResponseComplete: Record response complete
2016-02-29 16:10:27,259 - WARN
[net.shibboleth.idp.session.impl.PopulateLogoutPropagationContext:178] -
LogoutContext not found in HTTP session. Required state not found: {}
2016-02-29 16:10:27,259 - INFO [Shibboleth-Audit.LogoutPropagation:241] -
20160229T151027Z||||
http://shibboleth.net/ns/profiles/logout-propagation|||||||||
2016-02-29 16:10:27,260 - DEBUG
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile
Action RecordResponseComplete: Record response complete
When logout is initiated by SP, only the particular SP gets logged out
together with IDP session which gets destroyed. Other SP that participate
in the session remains logged in.
Can you please advise why doesn't it work?
What can be the issue?
Thanks,
Alex
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160229/e67b0a40/attachment-0001.html>
More information about the users
mailing list