Shibboleth SP logout issue

[Cantor, Scott]

> Assuming I can't trivially reproduce it, then I have no idea how a configuration
> could be manipulated to fail that way.

My sandbox seems to work fine. I note that the "final" log message is actually removal of the session. Maybe there's something going off the rails there and causing trouble, but I still don't know how that's possible.

-- Scott

2016-10-12 15:39:06 DEBUG Shibboleth.Listener [1]: dispatching message (default/Logout::run::SAML2LI)
2016-10-12 15:39:06 DEBUG Shibboleth.SessionCache [1] find: searching for session (_85f9236264360c4a677fa0ad19cb5cd0)
2016-10-12 15:39:06 DEBUG Shibboleth.SessionCache [1] find: reconstituting session and checking validity
2016-10-12 15:39:06 INFO Shibboleth.LogoutInitiator.SAML2 [1]: Conditional encryption of NameID in LogoutRequest failed: No peer encryption credential found.
2016-10-12 15:39:06 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1] encode: validating input
2016-10-12 15:39:06 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1] encode: marshalling, deflating, base64-encoding the message
2016-10-12 15:39:06 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1] encode: marshalled message:
<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://webauth.service.ohio-state.edu/idp/profile/SAML2/Redirect/SLO" ID="_0552dad1a4b799eb9a5bbaf26489d137" IssueInstant="2016-10-12T19:39:06Z" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.example.org/shibboleth</saml:Issuer><saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="urn:mace:incommon:osu.edu" SPNameQualifier="https://sp.example.org/shibboleth">AAlzZWNyZXQxODGDHU3o2O16Mncm9HCLnVWNrGxcjqENnww1BAOBmYKNMTO8uSwXGJoWo5pD4xDhvvW9nkIAIxs+rmyh+c6uXv4fHOe2BETuoTCLQB5LifwyZKwF9gGnBcXVfu/Bkio/8x1/dwcBf898JA==</saml2:NameID><samlp:SessionIndex>_c03aca0c01c539e97740f7f8a5bb7ced</samlp:SessionIndex></samlp:LogoutRequest>
2016-10-12 15:39:06 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1] encode: signing the message
2016-10-12 15:39:06 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1] encode: message encoded, sending redirect to client
2016-10-12 15:39:06 INFO Shibboleth.SessionCache [1] remove: removed session (_85f9236264360c4a677fa0ad19cb5cd0)
2016-10-12 15:39:08 DEBUG Shibboleth.Listener [1]: dispatching message (default/SLO/Redirect)
2016-10-12 15:39:08 DEBUG OpenSAML.MessageDecoder.SAML2Redirect [1] decode: validating input
2016-10-12 15:39:08 DEBUG OpenSAML.MessageDecoder.SAML2Redirect [1] decode: decoded SAML message:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:LogoutResponse Destination="https://sp.example.org/Shibboleth.sso/SLO/Redirect" ID="_433fdd50875d69f758bafe34393ef539" InResponseTo="_0552dad1a4b799eb9a5bbaf26489d137" IssueInstant="2016-10-12T19:39:08.740Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:osu.edu</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status></saml2p:LogoutResponse>
2016-10-12 15:39:08 DEBUG OpenSAML.MessageDecoder.SAML2 [1] decode: extracting issuer from SAML 2.0 protocol message
2016-10-12 15:39:08 DEBUG OpenSAML.MessageDecoder.SAML2 [1] decode: message from (urn:mace:incommon:osu.edu)
2016-10-12 15:39:08 DEBUG OpenSAML.MessageDecoder.SAML2 [1] decode: searching metadata for message issuer...
2016-10-12 15:39:08 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1] decode: evaluating message flow policy (replay checking on, expiration 60)
2016-10-12 15:39:08 DEBUG XMLTooling.StorageService [1] decode: inserted record (_433fdd50875d69f758bafe34393ef539) in context (MessageFlow) with expiration (1476301328)
2016-10-12 15:39:08 DEBUG XMLTooling.TrustEngine.ExplicitKey [1] decode validate: attempting to validate signature with the peer's credentials
2016-10-12 15:39:08 DEBUG XMLTooling.TrustEngine.ExplicitKey [1] decode validate: signature validated with public key
2016-10-12 15:39:08 DEBUG OpenSAML.SecurityPolicyRule.SimpleSigning [1] decode: signature verified against message issuer