SLO fails: IDP does not find matching session

[Cantor, Scott]

On 6/6/17, 11:54 AM, "users on behalf of Rainer Hoerbe" <users-bounces at shibboleth.net on behalf of rainer at hoerbe.at> wrote:

> Both the SP and IDP announce persistent nameIDs in their respective metadata. The IDP is configured to track sessions:

With what storage service? You can't turn those flags on without either using server side storage or flipping the HTML local storage property on also. I believe it actually detects that and warns about it at runtime somewhere but I don't recall for sure.

Otherwise the error isn't really that obvious given that it's a Shibboleth SP (nothing else would send that async extension). If it matches the original assertion, it should work.

That said, the DEBUG message seems wrong to me. The class shipped in opensaml 3.3 should be logging this on a LogoutRequest:

        } else if (samlMessage instanceof LogoutRequest) {
            log.debug("Ignoring LogoutRequest, Subject does not require processing");
        } else {
            log.debug("Message in resolved parent message context was not a supported instance of SAMLObject: {}", 
                    samlMessage.getClass().getName());
        }

I added that at some point to mask off the message you're getting since it was confusing. That seems like a clue perhaps, suggesting the IdP is corrupt and has a mix of jars or the wrong ones or something. Very odd.

There really should be more logging in between anyway, but given that there's not, it looks to me as though there's no IdPSession found to begin with for it to examine and try and find a match inside. So that says cookie problem to me.

-- Scott