SLO Keeping session

[Robert Lamothe]

Ok, so, idp.session.trackSPSessions and idp.session.secondaryServiceIndex properties were already set to true, but service side storage was not, so I set idp.session.StorageService = shibboleth.StorageService.  On the SP I'm getting the same error, but on the IDP I'm now getting:
2016-03-16 10:35:28,450 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:315] - Profile Action ProcessLogoutRequest: No active session(s) found matching LogoutRequest

Regards-Bob
--
Bob Lamothe
robert_lamothe at yahoo.com
KB1BOB
603-918-6336

 

    On Wednesday, March 16, 2016 10:05 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
 

 On 3/16/16, 9:48 AM, "users on behalf of Robert Lamothe" <users-bounces at shibboleth.net on behalf of robert_lamothe at yahoo.com> wrote:



>    In the Service Now logs I see:
>
>Failed to validate logout response status.  Expected: urn:oasis:names:tc:SAML:2.0:status:Success, actual: urn:oasis:names:tc:SAML:2.0:status:Requester

Ok, so it's a SAML logout and it's returning a failure status, so that's good, it means all the basic machinery is working.

>Based on the error in idp-warn.log it's suggesting that it can't find the session, my hope is that getting the session keeping working I'll have my solution.

If it's a SAML logout, the requirements for that are:

- you must set the idp.session.trackSPSessions and idp.session.secondaryServiceIndex properties to true
- you must use a server side storage service, or enable htmlLocalStorage to use the default client side service

If you don't do that, the expected outcome would be what you're getting.

I will take a pass over Marvin's draft docs in the wiki and try and clarify some things, I haven't had time to do it yet.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160316/5a397acb/attachment.html>