SLO Keeping session

[Cantor, Scott]

On 3/16/16, 10:40 AM, "users on behalf of Robert Lamothe" <users-bounces at shibboleth.net on behalf of robert_lamothe at yahoo.com> wrote:



>Ok, so, idp.session.trackSPSessions and idp.session.secondaryServiceIndex properties were already set to true, but service side storage was not, so I set idp.session.StorageService = shibboleth.StorageService.

That has significant clustering implications. Is this a one server system? If not, that won't work.

> 
> On the SP I'm getting the same error, but on the IDP I'm now getting:
>
>2016-03-16 10:35:28,450 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:315] - Profile Action ProcessLogoutRequest: No active session(s) found matching LogoutRequest

Well, the request S-N issued did not correspond to a session in the cache, generally indicating a NameID mismatch of some sort. You can turn up logging and you'll what NameID was issued to S-N and then what NameID it sent back in the LogoutRequest, that would be the starting point I guess. They have to match or the SAML protocol requires that it fail.

If that's all foreign, then you can read the SAML standard's SingleLogout protocol section, which is fairly short, and get a sense of how it works to understand how it can fail.

-- Scott