SLO Failure at one SP

[Aaron Howell]

Logout has been working fine with many other service providers - however I am having some trouble with logging out of a particular service provider. From that point of view it is probably something to do with the setup of this particular SP and I’m happy to take it up with the SP - but I’d like to have some understanding of what is actually failing:

The logs show that the session matching is not being successful

2017-06-06 16:55:33,644 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:834] - Performing secondary lookup on service ID https://sp.service-now.com and key MYUSER
2017-06-06 16:55:33,644 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:798] - Performing primary lookup on session ID 8dd21d3655f9f47dca0076ad6062a8b08c39997b6dbd08743c319515f424c6a1
2017-06-06 16:55:33,644 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:798] - Performing primary lookup on session ID a5914a5afad4173acdc228b21c492240ac048fa1c047763b21dec18643e134bf
2017-06-06 16:55:33,645 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:615] - Loading SPSession for service https://sp.service-now.com in session 8dd21d3655f9f47dca0076ad6062a8b08c39997b6dbd08743c319515f424c6a1
2017-06-06 16:55:33,645 - DEBUG [net.shibboleth.idp.session.SPSessionSerializerRegistry:86] - Registry located StorageSerializer of type 'net.shibboleth.idp.saml.session.impl.SAML2SPSessionSerializer' for SPSession type 'class net.shibboleth.idp.saml.session.SAML2SPSession'
2017-06-06 16:55:33,646 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:274] - Profile Action ProcessLogoutRequest: IdP session 8dd21d3655f9f47dca0076ad6062a8b08c39997b6dbd08743c319515f424c6a1 does not contain a matching SP session
2017-06-06 16:55:33,646 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:615] - Loading SPSession for service https://sp.service-now.com in session a5914a5afad4173acdc228b21c492240ac048fa1c047763b21dec18643e134bf
2017-06-06 16:55:33,646 - DEBUG [net.shibboleth.idp.session.SPSessionSerializerRegistry:86] - Registry located StorageSerializer of type 'net.shibboleth.idp.saml.session.impl.SAML2SPSessionSerializer' for SPSession type 'class net.shibboleth.idp.saml.session.SAML2SPSession'
2017-06-06 16:55:33,647 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:274] - Profile Action ProcessLogoutRequest: IdP session a5914a5afad4173acdc228b21c492240ac048fa1c047763b21dec18643e134bf does not contain a matching SP session
2017-06-06 16:55:33,647 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessLogoutRequest:320] - Profile Action ProcessLogoutRequest: No active session(s) found matching LogoutRequest
2017-06-06 16:55:33,648 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: SessionNotFound
2017-06-06 16:55:33,648 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] - Error event SessionNotFound will be handled with response


From what I have been reading on previous mail threads this is could be caused by a mismatch between the IdP and SP NameID - however this appears to not be the case:

This is in the login response:
        <saml2:NameID Format="urn:oid:0.9.2342.19200300.100.1.1"
            NameQualifier="https://idp.example.com/idp/shibboleth"
            SPNameQualifier="https://sp.service-now.com" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion”>MYUSER</saml2:NameID>

And this is in the Logout request:
    <saml2:NameID Format="urn:oid:0.9.2342.19200300.100.1.1" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">MYUSER</saml2:NameID>

Cheers,
Aaron

Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.