Reopened: Re: SessionNotFound

[Cantor, Scott]

On 6/2/17, 3:23 AM, "users on behalf of Martin Haase" <users-bounces at shibboleth.net on behalf of Martin.Haase at DAASI.de> wrote:

> I need to revoke my findings. I have tested this again: same user, same SP, using a non-tranisent NameID (uid).

I don't know what "this" is.

> The flow: Login in Browser A, Login in Browser B, _wait an hour_, Logout in Browser B, then Logout in Browser A.

The IdP always sends a SessionIndex when it requests a logout so it never tells an SP to revoke any but a specific device's session. Separate browsers would have logged in under a different SessionIndex. There is a way to turn that off and omit SessionIndex but it's not exposed as a setting so it's always on.

That said, I have no specific memory of the SP code. I know it honors SessionIndex but it may well have limitations around multiple sessions issued under one NameID/Issuer pair when it comes to logout, but they would be in the "more logout than expected" area, not less.

> This is what happens when using SAML SLO (<SP>/Shibboleth.sso/Logout): upon the second logout, the IdP returns the 
> SessionNotFound Error, no propagation, the Browser A user is still logged in at the SP.

A logout in one browser wouldn't impact the IdP's ability to find a session connected to the other browser, they're totally separate IdPSessions. So that just can't be right. Within a single browser, it's a different story.

> I can provide debug logs to highlight the difference between correct and incorrect SAML SSO on the one hand, and correct and
> incorrect proprietary Logout.

Logout is not my highest priority but you're welcome to file bugs and eventually I'll get around to looking at it all. I doubt anything you see is fixable, but I can eventually determine what it's actually doing.

> What ways would you recommend to handle this? In our set-up, the flow sketched will happen frequently.

I don't know what "this" is specifically, but what you're describing with multiple browsers doesn't really make sense to me as a possible interaction.

-- Scott