Routing Problems with SLO

[Klingenstein, Nate]

> It isn't the first step or there wouldn't be an execution parameter on the URL.

Now I'm double confused.  Quick Q.

How could you get a new JSESSIONID on the response if this wasn't treated as a naive client by the servlet container?

I get that the container had to generate both the JSESSIONID and the key in the prior response and the client is playing them back in this request, but that is then all after the actual problem, no?  Is it the lifetime of the HTTP session versus the lifetime of the other state signaling mechanisms?

https://wiki.shibboleth.net/confluence/display/IDP30/Clustering

This state is managed in a SWF component called a "flow execution repository", and by default this repository is implemented in-memory within the Java container and state is tracked by binding each flow execution to the container session (the one typically represented by the JSESSIONID cookie).