Routing Problems with SLO

Mon Oct 3 16:18:18 EDT 2016

Hi Everyone,

I'm working on migrating our IdP from Tomcat to a Jetty based Docker deployment. At the moment, everything works except for SLO. When a request is made to idp/profile/Logout, it appears as though logout_complete.vm is being rendered instead of logout_propagate.vm and so the user remains logged in. I don't see anything useful in the logs however I'll include them at the end of the email just in case.

The Docker version uses the same configs as our current production IdP, so I'm inclined to believe that the issue has to something to do with Jetty. Does anybody have any ideas?

Thanks,

    David Newswanger

idp-process.log: Login with attempt to log out.

2016-10-03 18:27:17,212 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:258] - Service 'shibboleth.ReloadableCASServiceRegistry': Reloading service configuration

2016-10-03 18:27:17,215 - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/opt/shibboleth-idp/conf/cas-protocol.xml]
2016-10-03 18:27:17,233 - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577] - Refreshing ApplicationContext:shibboleth.ReloadableCASServiceRegistry: startup date [Mon Oct 03 18:27:17 UTC 2016]; parent: Root WebApplicationContext
2016-10-03 18:27:17,251 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:378] - Service 'shibboleth.ReloadableCASServiceRegistry': Completed reload and swapped in latest configuration for service 'shibboleth.ReloadableCASServiceRegistry'
2016-10-03 18:27:17,252 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:385] - Service 'shibboleth.ReloadableCASServiceRegistry': Reload complete
2016-10-03 18:27:17,254 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:199] - Service 'shibboleth.ReloadableCASServiceRegistry': Reload time set to: 900000, starting refresh thread
2016-10-03 18:27:17,830 - INFO [net.shibboleth.ext.spring.context.DelimiterAwareApplicationContext:577] - Refreshing WebApplicationContext for namespace 'idp-servlet': startup date [Mon Oct 03 18:27:17 UTC 2016]; parent: Root WebApplicationContext
2016-10-03 18:27:19,093 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers []
2016-10-03 19:54:48,955 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'newswangerd' succeeded
2016-10-03 19:54:51,801 - INFO [Shibboleth-Audit.SSO:241] - 20161003T195451Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_47e28a38f22d2955404e6bec2afc2dd4|https://shibboleth2-vm.berea.edu/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibboleth2-vm.berea.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_9d4604f7a6a0c8d440c508d2e4ea20b4|newswangerd|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,surname,displayName,givenName,description,eduPersonPrincipalName,cn,EmailAddress|AAdzZWNyZXQxDgIfNcGumEpn1x1TsVD8XxOFAk6SyyBEWU2tADfxeoCJoGGKPsju4Ac+xoGsoVEr5srb7se05Ak+vJMUPZD5QqOvC3+MTuw6cmXtFxq74abL8e5V0bR8jSCyvonlDDFXxwBZwSyAZ5AiQxI0|_c132848c704935228676952cf0ef8c4c|
2016-10-03 20:00:40,254 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'newswangerd' succeeded
2016-10-03 20:00:40,844 - INFO [Shibboleth-Audit.SSO:241] - 20161003T200040Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_b0917adcf4c493b95b5aa6a450d53a65|https://shibboleth2-vm.berea.edu/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibboleth2-vm.berea.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_67af2da8a7bceb6aec334c2ce5c53f64|newswangerd|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,surname,displayName,givenName,description,eduPersonPrincipalName,cn,EmailAddress|AAdzZWNyZXQxT3xcgdOgTAtK/6u+drraEfXzZdjjaoVst8YfLcslC5SqSoysQs6Fg3j3s+7bRvJPPsgfQpfFUNt2RQAtfKKKpoeBYS4lFCEeB0zETGmN+ZoeatGE32B6qQ9QGJR146TumBvIHZt5xoqBm4Xh|_a9b63a695f07b41383b6a1b248cca7f2|

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161003/66343d8c/attachment.html>