Routing Problems with SLO

[Cantor, Scott]

> Logging out of the broken Docker version takes me to:
> /idp/profile/Logout;jsessionid=502910252EEEAB7310CD165D57926C04?execu
> tion=e1s1

Well, that's a step in the middle of the simple logout flow and doesn't really mean anything particularly good or bad. It isn't the first step or there wouldn't be an execution parameter on the URL.

> Logging out of the production one takes me to:
> /idp/profile/Logout?execution=e10s1&_eventId=propagate

No, it doesn't, not directly. That would be happening after the initial logout view renders and the user selects whether to do a global logout or not. That's not where it would start. That's just a sign that the client selected the full logout button and it's passed control to that step by signaling the propagate event.

There's nothing complete here or indicative of anything. I still don't know what your problem is really.

> What would be causing the logout event to not get recorded in the logs?

Most likely getting stuck somewhere waiting for the browser to do something and nothing ever coming back into the IdP to move it along and finish. The audit log is not the way to debug things, but client issues can't be debugged very easily at all.

> Where do I go to look at the session management? I've never had to directly
> debug cookies before, so any pointers on how to do this would be helpful.

Turn up logging to DEBUG and find some way to make the logs available along with a detailed explanation of what it's appearing to do.

I also really don't have much time to devote to debugging logout in 3.2, there were too many bugs fixed to spend the time. Wait a month or try a snapshot and reproduce it on 3.3.

-- Scott