SLO Request Not Signed

[Brian Moon]

Issue was indeed with the SP.  The config I had for this IdP included the
certificate fingerprint rather than the certificate itself.  Once I changed
that, the logout propagated to the SP just fine.

There is one issue still popping up, though.  After the request is sent to
the SP, the logout page will refresh and generate an error about a stale
request.  In the logs I see the following:
2017-04-14 12:02:06,857 - ERROR
[org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:76]
-
org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:
No flow execution could be found with key 'e3s3' -- perhaps this executing
flow has ended or expired? This could happen if your users are relying on
browser history (typically via the back button) that references ended flows.
        at
org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
Caused by:
org.springframework.webflow.conversation.NoSuchConversationException: No
conversation could be found with id '3' -- perhaps this conversation has
ended?
        at
org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)

Any suggestions on what I should be checking next?

Thanks!


Brian Moon
Senior System Administrator
Enterprise Systems
Santa Clara University
Office: 408.554.4830
bmoon at scu.edu

On Thu, Apr 13, 2017 at 5:45 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I'm forming a message right now to the SimpleSAMLphp user group to see if
> > they have any ideas what's going on with the SP.  Want me to check back
> in
> > once I figure out a solution?
>
> I think SSP definitely would support signed logout, so it seems likely
> this is a "wrong endpoint" issue perhaps. If nothing else, delete the
> redirect SLO endpoint from the metadata and see if POST works.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170414/19eae9c0/attachment.html>