Asynchronous SLO with IdP 3.3

[Cantor, Scott]

> idp-process.log shows:

Please don't use Nabble in the future, I didn't see any of the log output or other explanation you posted.

> I found a workaround editing the config-file
> /system/flows/saml/saml2/slo-front-abstract-flow.xml and inserted a new
> action-state *ExtractSubject1* to evaluate
> *PopulateDecryptionParameters*
> before action-state *ExtractSubject* is called.

Right, I believe that's the fix, I have a patch you can try below that I'm going to test. If you can apply it to the original and test, that would help.

-- Scott

Index: src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml
===================================================================
--- src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	(revision 8502)
+++ src/main/resources/system/flows/saml/saml2/slo-front-abstract-flow.xml	(working copy)
@@ -35,9 +35,16 @@
     <decision-state id="CheckAsync1">
         <!-- If parent DoInboundInterceptSubflow transition changes on 'proceed', the else clause needs to also change. -->
         <if test="opensamlProfileRequestContext.getInboundMessageContext().getMessage() instanceof T(org.opensaml.saml.saml2.core.LogoutRequest) and opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions() != null and !opensamlProfileRequestContext.getInboundMessageContext().getMessage().getExtensions().getUnknownXMLObjects(T(org.opensaml.saml.ext.saml2aslo.Asynchronous).DEFAULT_ELEMENT_NAME).isEmpty()"
-            then="ExtractSubject" else="OutboundContextsAndSecurityParameters" />
+            then="AsyncDecryptionParameters" else="OutboundContextsAndSecurityParameters" />
     </decision-state>
     
+    <action-state id="AsyncDecryptionParameters">
+        <evaluate expression="PopulateDecryptionParameters" />
+        <evaluate expression="'proceed'" />
+        
+        <transition on="proceed" to="ExtractSubject" />
+    </action-state>
+    
 
     <!-- LogoutRequest handling starts by loading client storage if needed. -->