Logout Issue "Secondary lookup failed on service ID"

[Cantor, Scott]

On 3/1/17, 12:06 PM, "users on behalf of Lukas Hämmerle" <users-bounces at shibboleth.net on behalf of lukas.haemmerle at switch.ch> wrote:

> However, that secondary key was used in the SAML assertion issued for
> that SP in the NameID:

I'd have to review the logging, but a very common bug with SPs is sending back the wrong Format in the NameID. I would at least check that in the request.

> So, it seems that the IdP should have that ID somewhere. Anybody has a
> clue what goes wrong here? Could it be that this is related to
> idp.session.StorageService = shibboleth.ClientSessionStorageService
> (Cookie based storage)?

Client storage is fine, but you have to enable HTML local storage, you can't do logout if cookies are the medium. That also means some clients could fail while others succeed, though most clients now support local storage.

I believe the UI needs to change to generally keep things at the IdP and get rid of some of the weird cases where it returns to the SP if something bad happens, that's not really a good thing for it to be inconsistent. We'd still send back the error in the hidden frame, but the IdP needs to handle the UI.

-- Scott