Now really Solved: SessionNotFound

[Cantor, Scott]

On 6/21/17, 9:55 AM, "users on behalf of Martin Haase" <users-bounces at shibboleth.net on behalf of Martin.Haase at DAASI.de> wrote:

> It turned out that using the invariable NameID actually prevented the
> second SLO event from happening, since the IdP's secondary index maps
> from (NameID,SPentityID) to SessionIDs, so it would only have one record
> for the two Login events.

Sorry, yes, I thought I did say that, but maybe that was to somebody else having a similar issue. I think we could probably enhance some of that, but I don't know at this point.

> Using the transient ID as a NameID (which is the default) does not
> create this problem, as it is being generated with each login event, so
> there are two records which can be resolved during SLO individually.

As a project, and a community, we urge in the strongest possible terms that no PII be passed in the NameID. Among other reasons, doing logout with PII in the NameID means you either add encryption from the SP to the IdP to protect the redirect-based messages, or you get PII in the web logs. Shibboleth includes an IdP decryption key now but nobody really wants to deploy that, and I don't blame them.

-- Scott