SLO Keeping session

[Cantor, Scott]

On 3/16/16, 9:48 AM, "users on behalf of Robert Lamothe" <users-bounces at shibboleth.net on behalf of robert_lamothe at yahoo.com> wrote:



>    In the Service Now logs I see:
>
>Failed to validate logout response status.  Expected: urn:oasis:names:tc:SAML:2.0:status:Success, actual: urn:oasis:names:tc:SAML:2.0:status:Requester

Ok, so it's a SAML logout and it's returning a failure status, so that's good, it means all the basic machinery is working.

>Based on the error in idp-warn.log it's suggesting that it can't find the session, my hope is that getting the session keeping working I'll have my solution.

If it's a SAML logout, the requirements for that are:

- you must set the idp.session.trackSPSessions and idp.session.secondaryServiceIndex properties to true
- you must use a server side storage service, or enable htmlLocalStorage to use the default client side service

If you don't do that, the expected outcome would be what you're getting.

I will take a pass over Marvin's draft docs in the wiki and try and clarify some things, I haven't had time to do it yet.

-- Scott