SessionNotFound

[Cantor, Scott]

> this Is IdP 3.3.0 and SP 2.6.0 on CentOS, openjdk version "1.8.0_121".
> We are experiencing a lot of "SessionNotFound" errors from the IdP upon
> SAML2 SLO. From what we can see, shortly after authentication, Front
> Channel Logout initiated by the SP works, but approx 1 hour after
> authentication, the IdP cannot find the SP's session anymore. We upped
> all corresponding parameters in idp.properties, to no avail:

Are you sure the SP in question is issuing correct requests? Is it all SPs, one SP? Shibboleth SP or something else?

> Do you have a clue why this is?

Offhand the only typical case is timeout or a situation where the user logs into the same SP a second time, but the logout refers to the original NameID (assuming transient IDs of course).

> Would it help to move to server-side session storage?

I couldn't say without knowing the cause but it shouldn't really make any difference.

-- Scott