SLO not working properly in IE

[Peters C.L.]

I've hit an issue with SLO support, which appears to be specific to IE. In most browsers, if I log in to an SP using my Shibboleth IdP, perform an SLO request and log out, everything is fine. If I then try to log in to the SP again, it prompts for authentication again. All is good.

Except in IE (and Edge).

After I successfully logout, and then try to log in again, I get an Exception thrown, in particular a ConstraintViolationException: context cannot be null or empty. Sadly this doesn't give a full stack trace, but I've tracked this down to the MemcachedStorageService class being given an empty string for a context parameter, which seems to be caused by the shib_idp_session cookie being blank rather than not existing. This seems to be caused by single log-out where Shibboleth attempts to expire the cookie by setting Max-Age on the cookie to 0 - something which IE doesn't seem to support. (this link has a demo: https://balanceiskey.github.io/2015/11/25/ie11-cookies.html).

Clayton