Now really Solved: SessionNotFound

[Martin Haase]

Hi Scott,

thanks for this - in the meantime I had sent a message to the list that
apparently did not make it there, I've pasted it below. Maybe our setup
is a bit strange since some of our accounts are meant to be shared. Thus
individuals would log in independently with the same credentials, and
they each want SLO on their browser.

Cheers

Martin


-------- Forwarded Message --------

Subject: 	Re: Reopened: Re: SessionNotFound
Date: 	Wed, 21 Jun 2017 14:27:47 +0200
From: 	Martin Haase <Martin.Haase at DAASI.de>
Organization: 	DAASI International GmbH
To: 	users at shibboleth.net



Hi,

I think now I got it. In the first place, I was missing another setting
that still was in its default value of 30 minutes,
*idp.authn.defaultTimeout**.* This is the short explanation that will
suffice for the impatient.

However, I took another detour: I had set the IdP's NameID to an
invariable value (i.e. the value of the LDAP attribute uid). This
actually prevented SLO to work in this setting:

  * same user,
  * same SP,
  * Flow:
     1. Login in Browser A,
     2. Login in Browser B,
     3. Logout in Browser B,
     4. Logout in Browser A.

It turned out that using the invariable NameID actually prevented the
second SLO event from happening, since the IdP's secondary index maps
from (NameID,SPentityID) to SessionIDs, so it would only have one record
for the two Login events.

Using the transient ID as a NameID (which is the default) does not
create this problem, as it is being generated with each login event, so
there are two records which can be resolved during SLO individually.

Thanks for all the help,

Martin



On 21.06.2017 15:33, Cantor, Scott wrote:
> On 6/21/17, 6:12 AM, "users on behalf of Martin Haase" <users-bounces at shibboleth.net on behalf of Martin.Haase at DAASI.de> wrote:
>
>> My suspicion is that the idp.session.timeout = PT8H (the inactivity timeout) is not being honored, see " 
>> inactivityTimeout=1800000" in this log snippet:
> That's the timeout of the authentication method/result, nothing to do with the session(s). It defaults to a half hour so that's what I would expect.
>
> I really don't understand the actual sequence involved here and the talk of multiple browsers has me pretty well confused, so you probably need to start a new thread, set the values very low so it can be observed in real time in some kind of test scenario.
>
> -- Scott
>
>

-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-0
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2267 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/df99e39e/attachment.p7s>