Routing Problems with SLO

[Klingenstein, Nate]

David,

The difference is that when you arrive at the broken Docker version, it thinks you're brand new, never before seen.  When you logout of production, it recognizes you fine.  That could be because of cookies, but it's probably not.

I presume it'd log something on a logout request even if it thought there was no active IdP session, so the most logical combination of the two issues would be that you're landing on different IdP's entirely when you come back.

I'd look closely at the delta between web flows.  The front channel should give you a pretty good idea what's going on.

You shouldn't need to understand IdP session management in depth to debug this one.  It should be pretty much cookies/local storage unless you've customized things.

Sorry, not much to go on,
Nate.

On Oct 4, 2016, at 1:37 PM, David E. Newswanger <David_Newswanger at berea.edu<mailto:David_Newswanger at berea.edu>> wrote:

Logging out of the broken Docker version takes me to: /idp/profile/Logout;jsessionid=502910252EEEAB7310CD165D57926C04?execution=e1s1
Logging out of the production one takes me to: /idp/profile/Logout?execution=e10s1&_eventId=propagate

What would be causing the logout event to not get recorded in the logs?

Where do I go to look at the session management? I've never had to directly debug cookies before, so any pointers on how to do this would be helpful.

Thanks for your help
    David Newswanger
________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>>
Sent: Monday, October 3, 2016 4:42:57 PM
To: Shib Users
Subject: RE: Routing Problems with SLO

> I'm working on migrating our IdP from Tomcat to a Jetty based Docker
> deployment. At the moment, everything works except for SLO. When a
> request is made to idp/profile/Logout, it appears as though
> logout_complete.vm is being rendered instead of logout_propagate.vm and
> so the user remains logged in. I don't see anything useful in the logs however
> I'll include them at the end of the email just in case.

Your logs are not showing any use of the logout feature.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161004/151f8eff/attachment.html>