SLO Keeping session

[Robert Lamothe]

Hi Scott,
    The truth is I don't want to spend any time on logout, but it isn't my choice.  Our SP is Service-Now and their portal has a logout button.  When you hit logout a brief screen flashes with the error "Can Validate SAML LogOutResponse", it then puts up a screen that says "Logout successful"

    Our CIO is insisting that we eliminate this error.  If we could suppress it on the Service Now side that would suffice, but so far Service Now has been unable to come up with a solution, so it's up to me to eliminate the error and right now getting SLO working seems to be the best solution.
    In the Service Now logs I see:
Failed to validate logout response status.  Expected: urn:oasis:names:tc:SAML:2.0:status:Success, actual: urn:oasis:names:tc:SAML:2.0:status:Requester
Based on the error in idp-warn.log it's suggesting that it can't find the session, my hope is that getting the session keeping working I'll have my solution.  Of course another possible solution would be to have a page that sends back the correct SAML response, but at my current level of knowledge this seems even more difficult than SLO.
Regards-Bob
--
Bob Lamothe
robert_lamothe at yahoo.com
KB1BOB
603-918-6336

 

    On Tuesday, March 15, 2016 5:54 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
 

 On 3/15/16, 4:59 PM, "users on behalf of Robert Lamothe" <users-bounces at shibboleth.net on behalf of robert_lamothe at yahoo.com> wrote:



>    I've solved most of my shib problems but I have one that is proving to be very sticky.

Logout is not something you want to spend time on unless you're prepared to spend a lot.

>My SP has a logout button which I've used redirect to point to my SLO.

Are you trying to do a SAML logout or use the proprietary "clear this session" endpoint at /idp/profile/Logout? They are fundamentally different. And that's all separate from the propagation of logout, which is possible for CAS and SAML, but only under very particular circumstances.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160316/10c75958/attachment.html>