SLO fails: IDP does not find matching session

[Rainer Hoerbe]

A logout request to an Shib IDP (V3.3) results in a SAML:2.0:status:UnknownPrincipal status.

Both the SP and IDP announce persistent nameIDs in their respective metadata. The IDP is configured to track sessions:
idp.session.trackSPSessions = True
idp.session.secondaryServiceIndex = True

The logfile shows:
<samlp:LogoutRequest
    Destination="https://idp.edushare.at/idp/profile/SAML2/Redirect/SLO"
    ID="_7ca387642abcd91f1a1eb4dfd3ee06f9"
    IssueInstant="2017-06-06T15:32:29Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://service.edushare.at/sp</saml:Issuer>
    <samlp:Extensions>
        <aslo:Asynchronous xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo"/>
    </samlp:Extensions>
    <saml2:NameID
        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
        NameQualifier="https://idp.edushare.at/idp.xml"
        SPNameQualifier="https://service.edushare.at/sp" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">aqcLvK/Aqgv4ZX2Iuu1h6Qioxmc=</saml2:NameID>
    <samlp:SessionIndex>_8d303ef453a853c3bc4134458f0e94ac</samlp:SessionIndex>
</samlp:LogoutRequest>


2017-06-06 15:32:29,250 - DEBUG [org.opensaml.saml.common.messaging.context.SAMLSubjectNameIdentifierContext:161] - Message in resolved parent message context was not a supported instance of SAMLObject: org.opensaml.saml.saml2.core.impl.LogoutRequestImpl
2017-06-06 15:32:29,253 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:315] - Profile Action ProcessLogoutRequest: No active session(s) found matching LogoutRequest


I got stuck here.

- Rainer