IDP v3.2.1 SLO issue

[Alex Moskvin]

Thank you very much for the fast feedback!

I tried ten latest Tomcat 8.0.x versions and all of them affected with this
issue.
Switched to the latest Jetty 9.3, and it seems resolved issue with the
logout - all SPs that participate in the session get invoked and session
really gets terminated.

Even sessions are terminated now, /idp/profile/Logout shows red cross near
the SPs.
This is what is shown in logs per each SP:

2016-03-01 17:39:51,922 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.messaging.handler.impl.CheckMandatoryIssuer' on INBOUND
message context

2016-03-01 17:39:51,922 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.LogoutResponseImpl'

2016-03-01 17:39:51,923 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication' on
INBOUND message context

2016-03-01 17:39:51,923 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.LogoutResponseImpl'

*2016-03-01 17:39:51,924 - WARN
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182] -
Profile Action WebFlowMessageHandlerAdaptor: Exception handling message*

*org.opensaml.messaging.handler.MessageHandlerException: Message context
was not authenticated*

* at
org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication.doInvoke(CheckMandatoryAuthentication.java:70)*

*2016-03-01 17:39:51,925 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: MessageAuthenticationError*

*2016-03-01 17:39:51,926 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:154] -
No SAMLBindingContext or binding URI available, error must be handled
locally*


What may be the issue?

Regards,
Alex


2016-02-29 17:46 GMT+02:00 Cantor, Scott <cantor.2 at osu.edu>:

> > 2016-02-29 16:10:27,257 - WARN
> > [net.shibboleth.idp.session.impl.PopulateLogoutPropagationContext:178] -
> > LogoutContext not found in HTTP session. Required state not found: {}
>
> That's the problem, and I would be inclined to blame the container.
> There's an object stashed in the container session so the steps running
> inside the iframe can retrieve it, and it's not there.
>
> > Can you please advise why doesn't it work?
>
> Given past experience, I would start with whether this is a supported
> container or not. If it's not Jetty 9 or Tomcat 8+ *from the
> tomcat.apache.org site*, then you should reproduce it on one of those.
>
> If it is, then the second thing would be load balancer issues, and the
> iframes hitting different systems. That won't work.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160301/8553b1cd/attachment.html>